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(57) Abstract 

A comprehensive real estate lockbox system (10) which 
provides a variety of operational features. Some of these fea- 
tures include the ability to: record all accesses to all lockboxes 
(12); transfer all or part of such records from the lockboxes (12) 
to a supervising real estate agency or board; organize and re- 
view such records; facilitate operation of lockboxes (12) that are 
mounted in awkward or poorly lit locations; limit lockbox ac- 
cesses to preselected agents, agencies or boards; reprogram 
lockboxes in the field; monitor redundantly the status of the 
lockbox battery (32); record diagnostic information on each op- 
eration of a lockbox (12) or key (14); render keys inoperative on 
predetermined dates; disable unauthorized keys; grant agents 
from remote real estate boards permission to open certain lock- 
boxes, and; grant different keys different privileges. 
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ELECTRONIC REAL ESTATE LOCKBOX SYSTEM 

15 BACKGROUND AND SUMMARY OF THE INVENTION 

The present invention relates to real estate 
lockboxes and other secure entry systems. Lockboxes are 
used in the real estate industry to contain the keys of 
houses listed for sale. Prior art lockboxes have 

20 primarily been mechanical devices which allow access to 
a secure compartment by use of a conventional key. Such 
lockboxes and keys, however, have had numerous 
disadvantages. These disadvantages have been overcome 
by the present invention and a great number of new 

25 features have been provided. 

One feature of the present invention is the 
provision of a code entry keypad on a lockbox key, 
rather than on the lockbox itself , thereby eliminating 
an opportunity for lockbox vandalism and preventing 

30 unauthorized passersby from communicating with the 
lockbox. 

Another feature of the invention is an 
arrangement whereby different keys can be programmed to 
become inoperative after different periods of time. 



35 
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Yet another feature of the invention is the 
ability of the lockbox to be reprogrammed in the field. 

Still another feature of the invention is the 
ability of the lockbox to be interrogated by a user to 
5 learn the number of times the lockbox has been accessed 
without returning the lockbox or an interrogating key to 
a central location. 

Yet another feature of the invention is an 
arrangement whereby a user can receive temporary 
10 authorization to access lockboxes owned by other real 
estate boards. 

Still another feature of the invention is an 
arrangement whereby lockbox battery power is conserved 
and solenoid work is reduced by delaying energization of 
15 unlocking solenoids until the lockbox is actually being 
opened . 

Yet another feature of the invention is the use 
of several independent lockbox battery monitoring 
criteria to avoid lockbox battery failure. 
20 Still another feature of the invention is the 

provision of two lockbox locking solenoids that are 
reciprocally mounted so that if one is jarred to an 
unlocked state, the other is jarred to maintain a locked 
state. 

25 Yet another feature of the invention is an 

arrangement whereby a manufacturer can provide a variety 
of different keys to its customers without tooling up 
several different manufacturing lines. 

Still another feature of the invention is an 

30 arrangement whereby real estate boards or agencies can 
limit the operations that individual keys can perform. 

Yet another feature of the invention is an 
arrangement whereby a user can log into a lockbox's 
access log without opening the lockbox. 



35 
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Still another feature of the invention is an 
arrangement whereby an agent who has listed a house can 
require visiting agents to enter an auxiliary access 
code before being allowed to open the lockbox, 
5 Yet another feature of the invention is the 

ability of the lockbox to render certain keys 
inoperative until they are reprogrammed. 

Still another feature of the invention is the 
recording of detailed diagnostic data about recent 
10 lockbox and key operations in order to facilitate 
resolution of anomalous lockbox and key behavior. 

Yet another feature of the invention is the 
ability of the lockbox to recognize the keys of 
preselected users and to prohibit them from opening the 
15 lockbox • 

Still another feature of the invention is the 
ability of the lockbox and key to cooperate so as to 
update a list of keys that are to be prevented from 
executing lockbox functions. 

20 Yet another feature of the invention is the use 

of a low power , yet long range electromagnetic 
communications technique for exchanging signals between 
lockbox, key and stand components. 

Still another feature of the invention is an 

25 arrangement whereby a user can enter the keystrokes 
needed to operate the lockbox into the key's keypad 
before the key is engaged with the lockbox, thereby 
facilitating operation of the lockbox in awkward or 
poorly lit locations. 

30 Yet another feature of the invention is an 

arrangement whereby the access log maintained in the 
lockbox can be marked so that less than the entire 
contents of the log can be supplied to a requesting user. 
The foregoing and additional features and 

35 advantages of the present invention will be more readily 
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apparent from the following detailed description of a 
preferred embodiment thereof , which proceeds with 
reference to the accompanying drawings. 

5 BRIEF DESCRIPTION OP THE DRAWINGS 

Pig. 1 shows a lockbox , a key, a stand and a 
computer used in a lockbox system according to the 
present invention. 

Fig. 2 is a rear view, partially in section, 
10 schematically illustrating portions of a lockbox 
according to the present invention. 

Pig. 3 is a sectional view taken along line 3-3 
of Fig. 2, schematically illustrating some of the 
locking components in a lockbox according to the present 
15 invention. 

Fig. 4 is a top view of a shackle locking bar 
used in the lockbox of Figs. 2 and 3. 

Pig. 5 is a rear elevational view of the 
shackle locking bar of Fig. 4. 
20 Pig. 6 is a right side view of a door stem used 

in the lockbox of Figs. 2 and 3. 

Fig. 7 is a front elevational view of a lockbox 
shackle used in the lockbox of Figs. 2 and 3. 

Fig. 8 is a sectional view of the case of the 
25 lockbox of Figs. 2 and 3 taken along line 8-8 of Fig. 2. 

Fig. 9 is a schematic block diagram of the 
electronic circuitry used in the lockbox of Figs. 2 and 
3. 

Fig. 10 is a plan view of a key according to 
30 the present invention. 

Fig. 11 is a left side view of the key of Fig. 

10. 

Fig. 12 is a schematic block- diagram of the 
electronic circuitry used in the key shown in Figs. 10 
35 and 11. 



Fig. 13 is a diagram illustrating portions of 
the electronic memories used by the lockbox and key of 
the present invention. 

Fig. 14 is a top plan view of a remote stand 
according to the present invention. 

Fig. 15 is a sectional view taken along lines 

15- 15 of Fig. 14 and showing the stand with two 
different sizes of keys. 

Fig. 16 is a sectional view taken along lines 

16- 16 of Fig. 14 and showing the stand coupled to a 
lockbox. 

Fig. 17 is a rear elevational view of the stand 
shown in Fig. 14. 

Fig. 18a is a schematic block diagram of the 
electronic circuitry used a local stand according to the 
present invention. 

Fig. 18b is a schematic block diagram of the 
electronic circuitry used in a remote stand according to 
the present invention. 

Fig. 19 is a schematic block diagram showing a 
digital reconstruction modulation system according to 
the present invention. 

Fig. 20 shows a radio system for updating 
lockboxes and keys according to the present invention. 

Fig. 21 shows a computer and trunk interface 
unit used in an enhanced version of the system of Fig. 1. 

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 
GENERAL OVERVIEW 
A basic lockbox system 10 according to the 
present invention, shown in Fig. 1, includes one or more 
lockboxes , or keysafes, 12 , electronic keys 14 , stands 
16 and computers 18. Lockbox 12 contains the door key 
to the listed dwelling and is mounted securely on or 
near the dwelling. Electronic key 14 is used by real 
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estate agents to open the lockbox and gain access to the 
dwelling key contained therein* Key 14 can also be used 
to read access log data from the lockbox and to load 
programming instructions into it. Stand 16 is used to 
5 interface computer 18 with the lockbox and key units. 
Computer 18 is used to store instructions in and to 
collect data from lockbox 12 and key 14 so as to 
integrate management of a lockbox system. 



10 LOCKBOX 

With reference to Figs. 2-3 f lockbox 12 
includes a secure enclosure , or house key compartment 20 
designed to contain house keys r business cards , written 
messages and the like. Lockbox 12 is securely attached 

15 to the listed house or other fixed object by a shackle 
22 or by screws (not shown) . Shackle 22 in most 
instances attaches the lockbox to a doorknob, water 
spigot or porch guard rail. Upon a proper exchange of 
signals between lockbox 12 and key 14, a door 24 to the 

20 lockbox house key compartment 20 can be opened, thereby 
allowing access to the house key and to other materials 
stored inside. 

The circuitry of lockbox 12 is shown in block 
diagram form in Pig. 9. Lockbox 12 includes a 

25 communications coil 26, a microprocessor (CPU) 28, a 
read/write (RAM) memory 30, a primary battery 32, a 
backup battery 34, a pair of key compartment locking 
solenoids 36, a pair of shackle locking solenoids 38, a 
key compartment solenoid drive circuit 40, an associated 

30 microswitch 42 and a shackle solenoid drive circuit 43. 

Communications coil 26 is used to electro- 
magnetically couple to corresponding coils in key 14 and 
stand 16. Microprocessor 28 controls operation of 
lockbox 12 according to programming instructions 

35 ("lockbox control software") permanently stored in an 
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associated read only memory (ROM) 44. RAM memory 30 is 
used to store various elements and strings of operating 
data. Primary battery 32 provides power to the lockbox 
circuitry. Backup battery 34 is used when the primary 
5 battery becomes weak or is removed for replacement. Key 
compartment locking solenoids 36 releasably lock house 
key compartment door 24 under the control of door 
solenoid drive circuit 40 and microswitch 42. Shackle 
locking solenoids 38 releasably lock shackle 22 under 

10 the control of shackle solenoid drive circuit 43. 

Although illustrated as a single component, 
lockbox CPO 28 is in fact two discrete microprocessor 
circuits. The first, a National Semiconductor 820 
Series Control Oriented Processor, is an eight bit 

15 processor that performs all control, communications and 
logic functions with the exception of timing and 
calendar -clock functions. These functions are performed 
by a National Semiconductor COP 498 processor which is 
mask programmed by the manufacturer to perform a variety 

20 of time keeping functions. The lockbox RAM 30 is 

comprised of a low power, low voltage Toshiba LC3517NC 
RAM circuit, which is organized as 2048 eight bit bytes. 

Lockbox CPU 28 stores information on certain of 
the operations that are executed, or attempted to be 

25 executed, by a key or the lockbox in a portion of RAM 
memory 30 termed the "access log." Each entry in the 
access log includes the identity of the key, the date 
and time of the operation (obtained from the 
calendar -clock portion of CPU* 28) , the function 

30 attempted and, if the function was denied, the reason 
why. In the illustrated exemplary embodiment, the 
lockbox access log can store information on 100 lockbox 
operations. This log can later be retrieved, in whole 
or in part, by key 14 or by stand 16 for transfer to 

35 computer 18 or for display on a CRT screen or printer. 
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Management of the lockbox access log is 
performed by lockbox CPU 28 in conjunction with a "roll 
flag" and a "pointer" stored in lockbox RAM 30. The 
roll flag indicates whether all 100 entries in the 
5 access log have been filled and consequently whether the 
memory is recycling, overwriting old data. The pointer 
indicates the address of the memory location at which 
the next access log entry will be stored. 

When the lockbox is initialized (discussed 

10 below in the section entitled Initialization and 

Deactivation of Lockboxes and Keys by the Computer) , the 
roll flag is set to "0" and the pointer is set to 
indicate the address of the first memory location in the 
access log. Thereafter , each entry in the log causes 

15 the pointer to increment to the address of the next 
memory location in the log. 

After 100 entries have been stored in the 
access log, the pointer recycles and indicates again the 
address of the first memory location in the access log. 

20 At this point , the rollover flag is set to "1," 

indicating that the access log has become a circular 
data buffer and that each additional entry will 
overwrite an earlier entry. 

25 Lockbox Characterization Instructions 

Lockbox 12 is characterized by "lockbox 
characterization instructions" loaded into lockbox RAM 
memory 30 by a computer through a stand. (Key 14 can 
also be used to load a set of limited characterization 

30 instructions into lockbox RAM memory 30 , as discussed 
below in the section entitled Functions) . The lockbox 
characterization instructions give the lockbox an 
identity, fix in it certain numerical values and enable 
it to perform certain functions. 

35 
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As shown in the illustrative lockbox memory map 
in Pig. 13 r the identification information loaded with 
the characterization instructions identifies the 
listing, the listing agent, the responsible agency and 
5 the responsible board. The identification information 
further identifies the lockbox by a unique lockbox 
serial number* 

Some of the numerical values loaded into the 
lockbox include a "Shown By Arrangement" (SBA) number, a 
10 key lockout list and a collection of lockbox access 
codes. 

Functions enabled by function enable bits in 
the characterization instructions may include Lockbox 
Disable On Removal and Privacy Read (both discussed 
15 below in the section entitled Programmable Lockbox 
Options) . 

After its initial characterization by stand 16 r 
lockbox 12 will not require further maintenance or 
programming until the lockbox is moved to a new location. 
20 Mechanical details of the lockbox 12 are 

discussed below in the section entitled Mechanical 
Construction of Lockbox. 

KEY 

25 With reference to Figs. 10 and 11, key 14 is 

constructed in a trim polycarbonate enclosure 46 sized 
to fit conveniently in a user's purse or pocket. The 
key includes a keypad 48 and an LCD display 50. Keypad 
48 is used to enter commands into the key. LCD display 

30 50 is used to display instructions and information to 
the user. 

LCD display 50 includes a central message 
portion in which messages from the system can be 
displayed to the user. Display 50 also includes a lower 
35 portion comprising a "prompt" field and an upper portion 
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comprising an "annunciator 11 field. The prompt field 
includes twelve potential prompts which represent twelve 
functions that a user can request the key to execute. 
They are OPEN, SHACKLE RELEASE, CHANGE PERSONAL CODE, 

5 CONTROLLER, READ PILE MARK, READ NN, READ, CLEAR MEMORY, 
SIGNATURE, SHOWN BY ARRANGEMENT, FILE MARK, and 
PROGRAM. These functions are discussed below in the 
section entitled Functions. 

The annunciator field includes five potential 

10 annunciators which indicate the status of various 

aspects of the key. The annunciators in the preferred 
embodiment are FUNCTION, READ, PROGRAM, KEYSAFE BATTERY 
and KEY BATTERY. 

The READ annunciator is made visible when the 

15 key contains lockbox access log data transferred from a 
lockbox during a READ operation. The PROGRAM 
annunciator is made visible when the key contains a set 
of limited characterization instructions that are to be 
loaded into a lockbox. The FUNCTION annunciator is made 

20 visible when the user is to select a function to be 
executed. The KEYSAFE BATTERY and the KEY BATTERY 
annunciators are made visible when the batteries for 
these respective units need attention. 

The circuitry of key 14 is shown in block 

25 diagram form in Fig. 12. Key 14 includes a 

communications coil 54, a key microprocessor (CPU) 52, 
the keypad or other switch mechanism 48, the LCD display 
50, a read/write memory (RAM) 56, a primary battery 58, 
a backup battery 60 and a beeper 62. 

30 Communications coil 54 is used to 

electromagnetically couple to the corresponding coils in 
lockbox 12 and stand 16. Microprocessor 52 controls 
operation of key 14 according to programming 
instructions ("key control software") permanently stored 

35 in an associated read only memory (ROM) 64. RAM memory 
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56 again comprises a Toshiba LC3517NC RAM circuit and is 
used to store various elements and strings of operating 
data. Primary battery 58 provides power to the key 
circuitry. Backup battery 60 is used when the primary 
5 battery becomes weak or is removed for replacement. 
Beeper 62 beeps to call the user's attention to the key 
in a variety of instances, such as when an error is 
committed or when the key and lockbox have successfully 
completed an operation. • 

10 Although illustrated as a single component, key 

CPU 52 also comprises two discrete microprocessor 
circuits. The first, a National Semiconductor 820 
Series Control Oriented Processer, is an eight bit 
processor that performs all control, communications and 

15 logic functions except reading data from keypad 48 and 
controlling operation of LCD display 50 and beeper 62. 
These functions are performed by a very low power NEC 
UPD7501 4 bit microcontroller with an on board LCD 
driver. The distribution of processing tasks between 

20 two processors in this manner reduces power consumption 
and increases operational efficiency by allocating the 
time consuming user interface chores to the very low 
power NEC processor, thereby allowing the logic 
functions to be more quickly performed using the higher 

25 power National processor. 



Key Characterization Instructions 
Key 14 is characterized by "key 
characterization instructions" loaded into key RAM 
30 memory 56 by a computer through a stand. These 

instructions give the key an identity, fix in it certain 
numerical values and enable it to perform certain 
functions. 

As shown in the illustrative key memory map in 
35 Fig. 13, the identification information loaded with the 
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characterization instructions identifies the agent, the 

responsible agency and the responsible board. The 

identification information further identifies the key by 

a unique serial number. 
5 Some of the numerical values loaded with the 

key characterization instructions include a four digit 

personal code, permission codes for various of the 

functions and various key access codes with associated 

expiration dates. 
10 Functions enabled by function enable bits in 

the characterization instructions may include OPEN, READ 

and SHACKLE RELEASE. 

After its initial characterization by stand 16, 

key 14 will not require further programming until any 
15 time dependent functions which may have been enabled , 

such as key expiration date or expiring key access codes 

(discussed below) need updating. 

Limited Function Keys 

20 This key described above can, if loaded with 

the proper characterization instructions, execute the 
entire complement of functions available on the system, 
here illustrated as twelve. In some applications, 
however, it is desirable to provide simpler keys which 

25 can effect only a limited range of functions. Thus, it 
may be desirable, for example, to provide keys that can 
perform just three functions: open a lockbox, drop a 
shackle and communicate with a computer. Such a simple 
key could be constructed without an LCD display. 

30 Limiting the functions that a key can perform 

can be effected by setting certain enable/disable bits 
in key RAM memory 56. In the preferred embodiment, key 
RAM memory 56 has an enable /disable data bit 
corresponding to each of the twelve functions. If the 

35 enable/disable data bit corresponding to a function is 
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set to a "1," the function is enabled. If set to a "0," 
the function is disabled. 

The enable/disable data in key RAM memory 56 is 
desirably set by the manufacturer so as to enable a 
5 particular set of functions. This arrangement permits 
the manufacturer to provide a variety of different keys 
to users having a variety of different requirements 
without the need to tool up a separate manufacturing 
line for each different key. If the manufacturer later 

10 wishes to change a key's enable/disable data, it can do 
so by reprogramraing the this data itself or by providing 
software to the responsible real estate board that will 
enable the board computer to reprogram this data. 

In an alternative embodiment , key RAM memory 56 

15 can have two data bits corresponding to each of the 
twelve functions. One of these bits is set by the 
manufacturer to a "O" or a T and cannot be altered by 
the user. The other of these bits can be. set to a "0" 
or a T by the authority that exercises supervisory 

20 control over the key, usually the local real estate 
board. In this alternative embodiment , the only 
functions that are enabled are those for which 
corresponding enable/disable data bits have both been 
set to a "l" by the appropriate authority. By this 

25 alternative system, the local real estate board is 

empowered to tailor the capabilities of its keys as it 
sees fit within the range of functions enabled by the 
manufacturer. 

30 Programmable Time Constants 

In the preferred embodiment, all time constants 
in the both the lockbox and key are set by data bits 
stored in the respective units 1 RAM memories (as 
illustrated by the lockbox and key memory maps of Pig. 

35 13). These time constants set, for example, the length 
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of time each of the transient displays are maintained in 
LCD display 50 and the length of time lockbox key 
compartment unlocking solenoids 36 are to be kept 
energized* 

5 

STAND 

Stand 16 is used in the present invention to 
transfer information between computer 18 and the lockbox 
and key components of a lockbox system. 

10 with reference to Figs. 14-17 r stand 16 can 

comprise an enclosure 66 having a protrusion 68. Within 
protrusion 68 is a stand communications coil 70- In 
use r a key or a lockbox is positioned on stand 16 as 
shown in Pigs. 15 and 16, respectively. In these 

15 positions, the communications coil within the lockbox or 
key is positioned in proximity with stand communications 
coil 70 in protrusion 68, thereby establishing 
electromagnetic coupling between such coils. 

In alternative embodiments, protrusion 68 can 

20 be omitted. In such embodiments, communications coil 70 
can be disposed within enclosure 66 so that it is 
adjacent the coils in corresponding lockbox or key units 
when such units are placed on the stand. 

As illustrated in Figs. 18a and 18b, stand 16 

25 is constructed in two forms. A first form of the stand, 
termed a local stand 16a, is designed to communicate 
with a computer at the same site. Local stands are thus 
intended for use at the board office, where they are 
tied directly to the board computer, or at agency 

30 offices, where they may be tied directly to a smaller 
computer. 

The second form of stand, termed a remote stand 
16b, is a portable unit designed to communicate with a 
remote computer over conventional telephone lines. 
35 Remote stands 16b are thus typically used at agency 
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offices that are not equipped with their own computers. 
Their portable nature , however , allows remote stands to 
be used wherever there is a phone line, such as at a 
property listed for sale, thereby enabling an agent to 
5 retrieve data from the board computer and provide a . 
homeowner immediate information about listing activity. 

With reference to Figs. 17, 18a and 18b, both 
forms of stand 16 include a microprocessor (CPU) 78, an 
associated read only memory 80, a read/write memory 

10 (RAM) 82 and a connector 83 for connection to a low 
voltage D.C. power supply. Local stand 16a further 
includes a cable connector 72 for connection to the 
local computer. Remote stand 16b further includes a 
modem 74 and two modular phone jacks 76, 7.7 for 

15 interfacing to a telephone line. First phone jack 76 is 
used to connect to the outgoing phone line. Second 
phone jack 77 is used to connect to a conventional 
telephone (hot shown) which provides dialing signals on 
the outgoing phone line. Remote stand 16b also includes 

20 a printer output port 79 for interfacing to a printer. 
This printer is driven by the remote computer through 
the stand and permits hard copy display of the data at 
the agency office or at the remote site at which the 
stand is used even though a computer is not locally 

25 available. 

Desirably, CPU 78 comprises an Intel 8051 
Series microprocessor and RAM 82 comprises a NEC UP04364 
8192 by 8 bit static RAM. 

In order to ensure data security , stand 16 

30 desirably encrypts the lockbox and key data before it is 
sent to the computer. Conversely, stand 16 decrypts the 
computer data before it is sent to the lockbox and key. 
This encryption/decryption is effected by microprocessor 
78 in conjunction with read only memory 80 and 

35 read/write memory 82. ROM memory 80 contains the 
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encryption and decryption algorithms used by stand 16 in 
communicating with computer 18. RAM memory 82 is used 
for temporary storage of data used in this process. 

The encryption algorithms employed are such 
5 that if the same data is exchanged between stand 16 and 
computer 18 several times, the several transmissions 
will bear no resemblance to one another. Decryption by 
unauthorized eavesdroppers is thus deterred. 

In the preferred embodiment , the data exchanged 
10 between stand 16 and the lockbox and key components is 
also similarly encrypted. 

Stand Functions. 
Stand 16 can perform a variety of functions in 

15 the present invention. First , stand 16 can provide a 
complete set of new characterization instructions for 
lockbox 12 or key 14 , or can simply modify an existing 
set of instructions. This is done by placing the key or 
lockbox on stand 16 , as illustrated in Figs. 15 and 16 , 

20 and executing a recharacterization program on computer 
18. The recharacterization program executed on computer 
18 interrogates the user, using a menu display format on 
the computer screen, as to which functions are to be 
enabled , what constants are to be loaded, etc. The 

25 characterization instructions generated by the 

recharacterization program are then transferred from the 
computer through the stand to the key or lockbox, where 
they are stored in RAM memory. 

A set of limited recharacterization 

30 instructions for lockbox 12 can alternatively be loaded 
from stand 16 into key 14 for later relaying by the key 
into the lockbox by using the PROGRAM function 
(discussed below in the section entitled Functions) . 

The second function stand 16 can perform is to 

35 retrieve data, such as lockbox access log data, from the 
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lockbox or the key and to relay it to computer 18 . This 
is accomplished by positioning lockbox 12 or key 14 on 
stand 16 and executing an appropriate program, this time 
a data retrieval program, on computer 18. 
5 Stand 16 can also be used for a variety of 

other purposes, such as for relaying diagnostic 
maintenance log data (discussed below in the section 
entitled Diagnostic Features) from the key or lockbox to 
the computer and for synchronizing the calendar-clock 

10 portion of lockbox CPU 28 with the master calendar -clock 
maintained by computer 18. 

One important feature provided by stand 16 is 
that it allows data transfers to and from the key and 
lockbox components without the need to take such 

15 components back to a central control computer at the 
real estate board office. In large metropolitan areas, 
such as Houston, the local real estate board may 
encompass several thousand square miles. Consequently, 
it is highly undesirable to require that lockboxes and 

20 keys be taken back to the board office every time an 

exchange of data is desired. The relatively inexpensive 
stands of the present invention can be distributed 
throughout the board's territory and can be used to 
effect all data transfers. Desirably, most of the 

25 agency offices within the real estate board would have 
such a unit and several additional units would be 
available for portable use within the board's territory. 

OPERATION 

30 To operate the lockbox system, the user first 

energizes, or wakes up, key 14 by pushing an ON /CLEAR 
button on keypad 48. Beeper 62 beeps to confirm that 
the key is energized. The key then displays the word 
"CODE" in the message portion of LCD display 50 in 

35 blinking form. The user then has a fixed time period. 
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such as one minute, within which to enter a four digit 
personal code. As each digit of the personal code is 
entered, an asterisk appears in LCD display 50. The 
asterisks maintain the privacy of the personal code 
5 while indicating the number of digits entered. If no 
personal code is entered within the one minute time 
period, key CPU 52 causes the key to become deenergized, 
or return to sleep, again. If the four digit personal 
code entered by the user matches the personal code 

10 stored in key RAM memory 56, the user is prompted to 
select a function. 

If an improper four digit personal code is 
entered on keypad 48, key 14 will not allow the user to 
select a function. The user can start over and try to 

15 enter the correct personal code. If, after four tries, 
the proper personal code has still not been entered, key 
CPU 52 causes the key to enter a "personal code timeout" 
mode in which, the key is deactivated for a ten minute 
period and during which it will not allow any further 

20 personal codes to be entered. 

After the four digit personal code has been 
successfully entered, the FUNCTION annunciator in the 
upper portion of LCD display 50 is made visible, 
together with the prompts in the lower portion of the 

25 display representing the available functions. (Key CPU 
52 causes the prompts corresponding to the functions 
that are not available, for example those functions 
which have been disabled, to remain invisible in LCD 
display 50) . The top left-hand most prompt in the 

30 prompt field, normally the OPEN prompt, will be 

blinking. It is the blinking prompt that indicates 
which function will be executed if the SELECT button is 
pressed. 

Movement of the blinking feature in the LCD 
35 prompt display is controlled by the RIGHT SCROLL and 



LEFT SCROLL buttons on keypad 48, The RIGHT SCROLL 
button causes the blinking feature to move one prompt to 
the right f for example , from OPEN to SHACKLE RELEASE. 
When the right-most prompt in a display line is blinking 
and the RIGHT SCROLL button is pressed, the blinking 
feature is moved to the left-most prompt in the 
following line. The LEFT SCROLL button moves the 
blinking feature in the opposite direction in a similar 
fashion. 

After the personal code has been entered 
successfully, it is the OPEN prompt that blinks. 
Consequently, to open the lockbox, which is the most 
common operation, the SCROLL buttons need not be 
operated at all. Instead, the SELECT button is simply 
pressed arid the lockbox can be opened. 

Once the SELECT button is pressed, CPU 52 
causes all of the prompts to be made invisible, except 
the selected prompt, which is caused to stay on 
continuously, not blinking. 

When the personal code has been successfully 
entered and a function has been selected, key 14 is 
termed "armed." In the armed state, the key sends out a 
signal, termed here a characteristic interrogation pulse 
train, and seeks to couple with a lockbox. When the key 
is ultimately coupled with a lockbox, the 
electromagnetic pulses radiated by the key induce a 
voltage in the lockbox communications coil. The 
induction of this voltage in the lockbox signals the 
lockbox to wake up. The lockbox then responds by 
transmitting a second signal back to the key, as 
discussed below in the section entitled Authorization of 
Lockbox Functions. 

When the OPEN feature has been selected, the 
four letter message field in the middle of LCD display 
50 displays the word "SAFE" (short for keysafe) in 
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blinking form. (A blinking message in the message 
portion of the display demands an action by the user. A 
solid display in the message portion indicates that the 
key is finished with the function) . When the "SAFE" 
message is blinking in the message portion of the 
display , the user has approximately ten minutes within 
which to engage a key with the lockbox. 

Once the key and lockbox are successfully 
coupled, the message display, instead of displaying the 
"SAFE" message in blinking form, displays a "WAIT" 
message in solid form. This indicates to the user that 
the key and lockbox are coupled and are communicating. 
During the "WAIT" state, various data is exchanged 
between the key and the lockbox and each of the 
microprocessors is making various decisions as to 
whether to authorize execution of the selected function 
(as described below in the section entitled 
Authorization of Lockbox Functions) . Finally, the 
processors decide, either together, or one informs the 
other, that the selected operation can be executed. 

After the requisite exchange of data between 
key and lockbox has successfully been completed and the 
requested function has been executed, the message in key 
LCD display 50 changes from "WAIT" to "GOOD." The 
"GOOD" message is displayed whenever any operation is 
successfully completed. The successful execution of the 
function is also confirmed audibly by beeper 62. The 
"GOOD" display is maintained for approximately eight 
seconds. The key then displays the KEYSAFE BATTERY 
annunciator if the lockbox battery is low (discussed . 
below in the section entitled Battery Systems) and then 
returns to sleep. 

If a user arms a key and then fails to complete 
the selected operation with a lockbox, the key 
eventually goes into an error condition. Beeper 62 
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beeps and an appropriate error code is displayed in the 
message display* The key then returns to sleep after 
displaying the error message for a predetermined time 
period. 

5 One important feature of the invention is that 

the key strokes necessary to request a function need not 
be entered while the key is coupled to the lockbox. As 
indicated , key 14 must be held near lockbox 12 in order 
for the units to communicate. Although not usually a 

10 problem, this task is sometimes difficult when the 

lockbox is mounted in a dark or awkward location, such 
as on a water spigot mounted at ground level. In some 
embodiments, the user would need to engage the key with 
the lockbox in such position and then start pressing 

15 buttons on keypad 48 corresponding to the required 
personal code and the desired function. 

To obviate this potential problem, the key 
control software allows the key to be armed in advance 
to request execution of a desired function. The key can 

20 then be mated momentarily with the lockbox and the 

handshaking signal exchanges made automatically when the 
lockbox detects the key's characteristic interrogation 
signal. Thus, the user need not press a single key in 
the dark or cramped location in which the key and 

25 lockbox may be mated in order to operate the lockbox. 
The personal code can be entered and the desired 
function selected in a convenient, well-lit location, 
such as in a car. The agent then has a fixed period, 
such as ten minutes, within which to use the armed key 

30 to operate the lockbox. After this period, the key 
disarms itself so as to maintain system security. 

In addition to providing a convenience to the 
user, the ability of the key to be armed at a remote 
location and later coupled with the lockbox to execute a 

35 function also provides an important security benefit. 
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That is, it allows the key to be armed away from prying 
eyes so as to maintain the secrecy of the user's 
personal code. 

5 FUNCTIONS 

Open 

a. 

To open house key compartment 20 in lockbox 12 , 
the user enters the four digit personal code on key 14, 
thereby causing the OPEN prompt in LCD display 50 to 

10 blink. The SELECT button is then pressed and an 

exchange of authorization signals between the lockbox 
and key is begun once the units are successfully 
coupled. If the lockbox and key determine that the 
function is authorized, lockbox CPU 28 allows key 

15 compartment door 24 to be opened. 

In the preferred embodiment, key compartment 
door 24 does not pop open when the exchange of signals 
has been completed successfully. Instead, a 
press-to-open mechanism is provided on the door. After 

20 the appropriate signals have been exchanged, the user 
presses door 24 inwardly and then releases. The door 
then pops open to reveal the contents of compartment 20. 

If the user does not open the press-to-open 
door within a predetermined period of time, such as 

25 sixty seconds, the lockbox reverts to its powered down, 
locked state. 

In order to conserve lockbox battery power, key 
compartment unlocking solenoids 36 are not energized 
until the user presses the press-to-open door. To 

30 effect this power savings, lockbox 12 is provided with a 
raicroswitch 42 connected in key compartment solenoid 
driye circuit 40 so that when door 24 is pressed in, the ^ 
microswitch is engaged and closed. VJhen door 24 is 
pressed in, CPU 28 detects the closure of microswitch 42 

35 and causes drive circuit 40 to then apply energy to key 
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compartment solenoids 36 for a brief period* The 
solenoids retract , thereby unlocking door 24. The user 
then releases the door and it pops open under the 
influence of a spring. The solenoids are thus not 
energized until the user is actually ready to open the 
door. (The solenoids are arranged in lockbox 12 so that 
the inward pushing movement of key compartment door 24 
is allowed even when the solenoids are in their locked 
state) . 

After microswitch 42 is reopened by the door 
popping open r lockbox CPU 28 waits approximately 0.25 
seconds and then causes drive circuit 40 to deenergize 
the solenoids. It has been found that in a typical 
opening , the locking solenoids are energized for less 
than 0.5 seconds. After deenergizing the solenoids, the 
lockbox returns to its sleeping state. 

If door 24 is pressed in but is not released 
for more than 1.25 seconds, solenoids 36 are deenergized 
to secure the lockbox and the lockbox returns to sleep. 

In the preferred embodiment, key compartment 
door 24 is provided with two solenoids to enhance 
lockbox security. Each solenoid has a spring loaded 
plunger. If only a single solenoid were used f the 
solenoid could be dislodged momentarily from its locking 
position by a sharp blow to the lockbox. The shock 
could propel the solenoid plunger momentarily to its 
retracted state, allowing door 24 to be opened. 

In the preferred embodiment, two solenoids are 
used and are disposed so that their plungers travel in 
opposite directions. If the lockbox is sharply rapped 
so as to propel one solenoid plunger to its unlocked 
position, the other solenoid plunger is propelled to its 
locked position. 

In an alternative system using a single 
solenoid, a rotary solenoid could be used. However, 
such an arrangement is less efficient and more expensive 
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than the present system and also requires additional 
latching components. 

Shackle Release 
5 The shackle 22 or mounting bracket which 

secures lockbox 12 to a structure is, in the preferred 
embodiment, released on command from a key. By allowing 
real estate agents to administer lockboxes, rather than 
just real estate board employees, administration of 

10 large lockbox systems is facilitated. 

To release lockbox shackle 22, the user enters 
the four digit personal code into the key and moves the 
blinking feature in the prompt field to SHACKLE 
RELEASE. The SELECT button is then pressed and a "SAFE 

15 message begins blinking in key LCD display 50. After 
the lockbox and key are coupled, these units exchange 
signals and, if these units decide that a shackle 
release is authorized, a "GOOD" message appears in LCD 
display 50 and a shackle release is permitted. 

20 In the preferred embodiment of the invention, 

the SHACKLE RELEASE function opens lockbox door 24. 
Actual release of the shackle is then effected by 
movement of a press-to-release shackle locking stem 162 
(which is unlocked by shackle locking solenoids 38) r 

25 which in turn moves a shackle locking bar 148 out of 
engagement with the shackle. Like the key compartment 
door arrangement, the shackle locking system also uses a 
pair of reciprocally mounted solenoids to lock the 
shackle so as to enhance lockbox security. 

30 

Change Personal Code 
When the user desires to change the four digit 
personal code, the CHANGE PERSONAL CODE function is 
used. The key is activated by the usual sequence of 
35 entering the four digit personal code and then moving 
the blinking feature in the prompt field until the 
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CHANGE PERSONAL CODE prompt is blinking. t When the 
SELECT button is pressed, the message display displays 
"NEW. " The user then keys in the new four digit 
personal code that is to be substituted for the old 
5 code. Each time a digit of the new code is entered , an 
asterisk appears in the message portion of display 50. 
After all four digits have been entered , the "NEW" 
message is displayed again. The user then reenters the 
new code. By this redundant technique, key CPU 52 

10 double checks the new personal code to insure that the 
user did not inadvertantly press a wrong key and thus 
enter a new personal code that was not intended and 
consequently would not be remembered. 

After the successful entry of the new four 

15 digit personal code twice, the message display portion 
of LCD display 50 indicates "GOOD" to confirm that the 
operation has been completed satisfactorily. 

Controller 

20 As discussed earlier, a stand is used to 

exchange data and characterization instructions between 
the key and the computer. One way in which data can be 
exchanged between these units is simply to lay the 
sleeping key on the stand and press the ON/CLEAR 

25 button. The stand then couples electromagnet ically to 
the energized key and allows the key to communicate with 
the computer. However, for security reasons, it is 
desirable that the computer not be allowed to perform 
the full range of possible functions on the key when the 

30 key is activated in this manner. An unauthorized user 
of a key could take the key and reprogram it if no 
further precautions were taken. Accordingly, it is 
desirable to limit the functions that the key and 
computer can cooperate to perform when the key is merely 

35 energized by the ON/CLEAR button to a narrow group of 
functions, such as running diagnostic routines and 



WO 87/05069 



PCT/US87/00374 



resetting the master software switch (discussed below) . 
Thus the key will not permit new characterization 
instructions to be loaded. 

In order for computer 18 to be allowed to 
5 perform its full complement of functions on the key f the 
key must be activated in the CONTROLLER mode by an 
authorized user. To do this r the user enters the four 
digit personal code and moves the blinking feature in 
the prompt field to CONTROLLER. When the SELECT button 

10 is pressed, the key permits the computer to freely read 
from and write to the key within the limits set by 
ownership of the key (i.e. a computer cannot reprogram a 
key if the key belongs to a different board) . 

Arming the key in the CONTROLLER mode is the 

15 only instance in which the key does not send* out its 
characteristic intAr rogation pulse train. Instead, the 
key listens for data or instructions relayed from the 
stand. 

20 File Mark 

Skipping ahead in the key's prompt field 
somewhat, the FILE MARK function is selected to put a 
mark in the access log maintained by the lockbox. As 
noted, the illustrative access log maintained in RAM 

25 memory 30 of lockbox 12 contains data relating to the 
last 100 lockbox operations. Oftentimes, however, not 
all 100 past operations are of interest. For example, 
the supervising real estate board or agency may only be 
interested in operations over a certain period of time. 

30 To facilitate this function, the lockbox access log can 
be marked with file marks. The log can then be' read in 
its entirety, or just from the last file mark to the 
end. By this technique, only the data of interest need 
be reviewed. 

35 The FILE MARK function is useful when a real 

estate agency or board is interested in monitoring the 
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access to a home during a specific period, as for 
example , during a weekend that the house is advertised 
in the newspaper. In such case f the listing agent could 
enter a file mark in the lockbox access log on a Friday 

« 

5 evening. (Only the listing agent, or the listing 

agent's broker or board, is permitted to executed a FILE 
MARK function on a lockbox) . An agent could then return 
the following Monday morning and recover only those 
entries in the access log made since the log was marked 

10 by using the READ FILE MARK function. 

If a lockbox is moved from one house to 
another, a file mark can be used to indicate in the 
access log when the lockbox was moved. In one form of 
the invention, a file mark is entered in the access log 

15 automatically whenever the shackle is released. Data 
can then be selectively recovered from the access log so 
that only operations logged at the new location are 
recovered. 

The entry that is actually recorded in the 
20 access log by a FILE MARK function is the same as any 
other logged function, but the log indicates that it is 
a FILE MARK function, rather than an OPEN, SHACKLE 
RELEASE, etc. The lockbox also records the other data 
usually stored in the access log, such as the identity 
25 of the user who executed the FILE MARK function, the 
date and time, etc. 



Read 

When the READ function is selected, lockbox CPU 
30 28 causes all of the entries stored in the lockbox 
access log to be transmitted to the requesting key by 
relaying the access log data via the units* coupled 
communications coils. The key stores this received 
information in a portion of its RAM memory 56 dedicated 
35 to this purpose. 
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The portion of key RAM memory 56 dedicated to 
storing lockbox access log data can be larger or smaller 
than the portion of memory in the lockbox dedicated to 
this task* Typically, the dedicated key memory is at 
5 least as large as the dedicated lockbox memory (i.e. 
large enough to hold at least 100 access entries) . A 
key can thus read several lockbox access logs, provided 
the total number of access log entries read does not 
exceed the key's capacity. 

10 If a user attempts to read a lockbox that has 

more access log entries than the key has memory, the key 
will display a corresponding error message and will not 
execute the READ function. 

Successful execution of the READ function does 

15 not cause the access log data in the lockbox to be 

erased. Instead, the data persists and is eventually 
overwritten by the lockbox itself, beginning when the 
one hundred and first log entry overwrites the first log 
entry. When the lockbox is later reinitialized and 

20 moved to a new listing, the access log data is dumped to 
a stand and the roll flag and pointer are reset to their 
initial states. 

As noted earlier, if any lockbox access log 
data is stored in the key, the READ annunciator will be 

25 made visible when the key is awakened by the ON/CLEAR 
button so as to remind the user that one or more reads 
are stored in the key. 

Read File Mark 

30 READ FILE MARK is identical to the basic READ 

function except that only the lockbox access log entries 
since the last file mark are read; 

Read NN 

35 Lockbox CPU 28 maintains a lockbox access count 

in lockbox RAM memory 30 that indicates the number of 
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OPEN, SBA and SIGNATURE functions that have been 
executed by the lockbox since it was reinitialized for 
that particular listing. In the preferred embodiment, 
this count is stored as a single eight bit byte and thus 
5 can count up to 255 accesses. When the READ NN function 
is selected and executed, lockbox CPU 28 transmits this 
lockbox access count to the key where it is displayed to 
the user in the message portion of LCD display 50. 

This READ NN function allows the user to 

10 monitor listing activity at a glance, without 

downloading data from the key to a stand at a remote 
location. This function also allows a user to monitor 
lockbox usage so that the maximum memory capacity of the 
lockbox access log will not be exceeded and old data 

15 overwritten. For example, if the lockbox access log can 
store 100 entries and the user determines, by using the 
READ NN function, that there have been 90 accesses to 
the listing, the user may choose to then dump the 
contents of the log into the key for later relaying to a 

20 computer through a stand. By such operation, the old 
data in lockbox access log is preserved in the computer 
and up to 100 new entries can then be logged in the 
lockbox. 

25 Clear Memory 

The CLEAR MEMORY function clears both the 
portion of key RAM memory 56 dedicated to storing 
lockbox access log data and the portion of the key RAM 
memory dedicated to storing lockbox characterization 

30 instructions. 

The lockbox access log data normally stays in 
key RAM memory 56 until the key is coupled to a stand 
and the data dumped to a computer. If, for some reason, 
the user does not want to preserve this data he can, 

35 instead of dumping it out to the computer, simply select 
the CLEAR MEMORY function and erase it. 
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The lockbox characterization instructions 
stored in key RAM memory 56 can variously stay in the 
key memory only until loaded into a lockbox or they can 
stay indefinitely , depending on the nature of the 
5 instructions (discussed below in the discussion of the 
PROGRAM function) . If , for some reason f the user does 
not wish to preserve this data f the CLEAR MEMORY 
function can be selected to erase it, 

10 Signature 

The access log maintained in the lockbox is 
useful for reasons other than determining, for security 
purposes, who opened the lockbox. It is also desirable, 
for management information purposes , to be able to 

15 determine the identity of persons who entered the house 
without opening the lockbox. 

Real estate agents often visit newly listed 
houses in large tour groups. The identity of the one 
agent in the group that opens the lockbox is of course 

20 entered in the access log. The identity of the other 
agents in the group could also be logged in the access 
log if they were also to open the lockbox. However, the 
OPEN function draws a considerable amount of power from 
the battery. Consequently, it is desirable to be able 

25 to log the identity of agents without requiring them to 
open the lockbox. The SIGNATURE function performs this 
task. 

Agents who select the SIGNATURE function can 
engage their keys with the lockbox and have their 

30 identities logged in the access log. The lockbox treats 
this function as an OPEN operation, but omits the final 
step of energizing the solenoids. Consequently, the 
power drain is negligible. By use of this function, the 
system is better able to maintain detailed information 

35 on visitors to a listed property. 
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The SIGNATURE mode has applications beyond real 
estate lockboxes. For example, a night watchman at an 
industrial complex could use the SIGNATURE function to 
log the date and time of his visits to the various locks 
5 around the complex without opening any such locks. A 
record could thus be maintained of the surveillance 
activity at various sites around the premises. 

Shown By ^Arrangement 

10 SHOWN BY ARRANGEMENT (SBA) is a function that 

allows a listing agent to restrict which other agents 
are allowed access to certain listed properties. 

Certain homeowners do not wish every agent in a 
real estate board to be able to gain access to their 

15 homes. They have placed their trust in one listing 
agent and want only agents authorized by that agent to 
show the house. However f it is impractical for the 
listing agent to be present at each such showing. The 
Shown By Arrangement feature of the present invention 

20 allows the listing agent to program the lockbox to 
require that a second code, an SBA code, be entered 
before access to the house key is granted. 

The SBA function is activated by specifying a 
desired four digit SBA code in the lockbox 

25 characterization instructions. If no SBA code is 

specified, a default value of 0000 is stored. When an 
agent tries to access a lockbox for which a non-zero SBA 
code has been specified, he or she must do so by first 
selecting the SBA function. When the key is so armed in 

30 the SBA mode, the agent is then prompted to select one 
of two functions from the prompt field: OPEN or CHANGE 
SBA. 

If the OPEN function is selected, a "SBA" 
message is displayed in blinking form in the LCD 
35 display, prompting the agent to enter the SBA number. 
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The agent then enters the four digit SBA number and 
corresponding asterisks appear in the LCD display. 
After the code is entered, it is transmitted to the 
lockbox with the request to execute the OPEN function. 
5 If the SBA code entered matches the SBA code stored, and 
if other authorization criteria discussed below are met, 
the function is executed. If the SBA code entered does 
not match the SBA code stored, the function is 
immediately denied. 

10 The second option after arming the key in the 

SBA mode is to change the SBA number. (When the key is 
armed in th~ SBA mode, a CHANGE prefix is made visible 
in LCD display 50 next to the SBA prompt to permit 
selection of the CHANGE SBA function)*. This option can 

15 only be executed by the listing agent, the listing 
agent's broker or the listing agent's board. The 
lockbox checks that the identity of the key corresponds 
to one of these entities by comparing key identifying 
data sent from the key with the lockbox identifying data 

20 stored in lockbox RAM 30. 

When the CHANGE SBA function is selected, a 
"NEW" message appears in the key LCD display 50 in 
blinking form, requesting the user to enter the new SBA 
number. Again, like changing the four digit personal 

25 code, this new SBA number must be entered twice in order 
for the change to be effected. 

Program 

The PROGRAM function transmits a set of limited 
30 characterization instructions from a key to a lockbox to 
effect a reprogramming of the lockbox in the field. Key 
CPU 52 will not make visible the PROGRAM prompt nor 
permit selection of the PROGRAM function unless the CPU 
has earlier determined that the key contains a set of 
35 limited lockbox characterization instructions waiting to 
be downloaded into a lockbox. 
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The lockbox programs that can be loaded into 
the key from the computer in the exemplary embodiment 
can be of two types: Specific Update and Blanket 
Update. Specific Update is used when a set of lockbox 
characterization instructions is destined for one 
particular lockbox , identified by that lockbox's serial 
number. Once the program has been downloaded to that 
lockbox r key CPU 52 automatically erases it from key RAM 
memory 56. Specific Update is generally used to change 
a lockbox's Daily Disable times and to set data switches 
enabling Privacy Read and Privacy Shackle Release 
(discussed below in the section entitled Programmable 
Lockbox Options) . 

Blanket Update, in contrast, is used when a set 
of lockbox characterization instructions is destined for 
a group of lockboxes. Downloading the instructions to a 
lockbox does not erase the instructions from key RAM 
56. Instead, the instructions persist in the key until 
erased by the CLEAR MEMORY key. 

Blanket Update is generally used to 
recharacterize lockbox instructions on an agency- or 
board-wise basis. Blanket Updates generally fall into 
two classes: those that update the lockout list and 
those that reprogram the identity of the lockbox's 
listing agent. 

Both Specific and Blanket Updates are 
transferred to the lockbox by using the PROGRAM 
function. The difference between the two is an update 
type data string included with the key programming 
instructions which indicates whether the update is a 
Specific Update or a Blanket Update, and, if it is a 
Blanket Update, whether it updates the lockout list or 
the listing agent. 

In the preferred embodiment, the programming of 
the lockbox by the key in the field is limited so that 
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only certain of the lockbox characterization 
instructions can be reprog rammed by the key. In the 
exemplary embodiment only the Lockout List data, the SBA 
number, the Daily Disable times and the listing agent 
5 identity can be reprogrammed in this manner , as is 
indicated in Fig. 13. The other data, such as the 
house, board and agency identification data and the 
lockbox access codes, cannot be changed by the key. To 
change this restricted data, the illustrated lockbox 

10 must be returned to a stand for reprogramming directly 
by a computer. 

The memory map of Fig. 13 illustrates that 
separate portions of key RAM memory x 56 are dedicated to 
storing lockbox characterization instructions and copies 

15 of lockbox access logs. In other embodiments, a single 
portion of key RAM memory 56 can be shared for these 
purposes. 

PROGRAMMABLE KEY OPTIONS 
20 The instructions needed to implement the 

following key options are provided with the key control 
software stored in key ROM 64. These options are then 
individually enabled or disabled by setting appropriate 
enable /disable bits stored in key RAM 56 with the key 
25 characterization instructions. 

Key Expiration Date 
To enhance security of. the system, some or all 
of keys 14 can be programmed to "expire" (become 
30 disabled) after a predetermined number of days. By this 
technique, keys that are lost or stolen lose their 
utility in a relatively short time. 

In RAM memory 56 of key 14 is data 
corresponding to a julian expiration date on which the 
35 key is to expire. Before any functions requested by the 
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key are authorized, key CPU 52 first compares this 
expiration date with data received from the 
calendar -clock portion of lockbox CPU 28 indicating the 
current date. If key CPU 52 determines that its 
5 expiration date has passed, the requested function is 
denied. A signal is sent to lockbox 12 informing 
lockbox CPU 28 of the expired key for logging in the 
lockbox's diagnostic maintenance log (discussed below in 
the section entitled Diagnostic Features) . A 

10 corresponding entry is made in the key's diagnostic 

maintenance log. The key then displays an error message 
indicating an expired key in the message portion of key 
LCD display 50. After the message has been displayed 
for a predetermined period of time, the key reverts to 

15 its sleeping state. 

This expiration date feature significantly 
enhances system security without imposing any 
significant burden on users of the system. Expired keys 
can be "rejuvenated" by an appropriate authority, 

20 usually the supervising real estate board, by simply 
loading a new expiration date into key RAM 56 via a 
stand. 

The present expiration feature also offers the 
supervising board and the individual users considerable 

25 operational flexibility. For example, the board can set 
a key to expire on any desired date. A key can thus be 
programmed to expire in a day, a week, a year or never, 
in increments of one day. (To program the key to never 
expire, this function is simply not enabled). This 

30 flexibility also enables the board to set different 
expiration dates for different keys. For example, it 
^ may wish the keys of new agents to require rejuvenation 

every two weeks, those of established agents to require 
rejuvenation every two months and those of brokers to 

35 require rejuvenation only every two years. The 
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expiration dates of the various keys can also readily be 
staggered so that all the keys in the system will not 
need to be rejuvenated on the same day. The system 
offers flexibility to users in that a key can be 
5 rejuvenated before it expires. A key owner can thus 
rejuvenate a key at a time when it is convenient , rather 
than at a time dictated by the lockbox owner. 

Key Deactivation 
10 Key 14 can selectively be deactivated to 

disable its further use by setting an appropriate 
disable bit in key RAM 56. This is useful when, for 
example, a board or an agency wishes to store unused 
keys. After being deactivated, key 14 must be 
15 reinitialized with new characterization instructions 
from the board or other supervising authority before it 
can be used again. 

PROGRAMMABLE LOCKBOX OPTIONS 
20 The instructions needed to implement the 

following lockbox options are provided with the lockbox 
control software stored in lockbox ROM 44. These 
options are then individually enabled or disabled by 
setting corresponding enable/disable bits stored in 
25 lockbox RAM 30 with the lockbox characterization 
instructions. 

Daily Lockbox Disable 
Oftentimes , homes listed by real estate agents 
are not vacant. The current owner may still be residing 
30 in the house and may not welcome visitors at certain 
hours. For example , a homeowner may work in the 
evenings and sleep during the days and consequently wish 
that his house not be shown between the hours of 
7:00 a.m. and 3:00 p.m. To accommodate such homeowners, 
35 CPU 28 of lockbox 12 can run a software routine , stored 
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in lockbox ROM memory 44, that disables the lockbox from 
opening during certain hours of the day. The daily 
lockbox disable software routine operates in conjunction 
with the calendar-clock portion of lockbox CPU 28 and 
5 with programmable time data indicating the desired 
beginning and end times of the daily lockbox disable 
period. These beginning and end times are loaded into 
lockbox RAM memory 30 with the lockbox characterization 
instructions and can be loaded by an appropriately 

10 programmed key 14. 

In the preferred embodiment of the present 
invention, lockbox CPU 28 is programmed to correct its 
internal calendar -clock data automatically to account 
for time changes brought on by daylight savings time so 

15 as to maintain the desired daily disable times. 

Similarly, the calendar-clock portion of lockbox CPU 28 
also corrects itself for leap years. 

Lockbox Disable On Removal 

20 After a real estate agent has released a lock- 

box shackle, the lockbox could normally be reinstalled 
on another house. Before such installation, however, 
the lockbox should be be reinitialized and loaded with a 
variety of new characterization instructions identifying 

25 the new listing, the listing agent, the listing agency, 
etc. In certain embodiments, this recharacterization 
could be accomplished by loading a key 14 with all of 
the new instructions and loading the lockbox from the 
key using the PROGRAM function. 

30 in most systems, however, this field 

reprograraming procedure is undesirable. It does not 
guarantee that thq characterization instructions loaded 
by computer 18 into key 14 are actually transferred, into 
the lockbox. More importantly, it does not guarantee 

35 that the access log data stored in the lockbox is 
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recovered and relayed back to the computer for archival 
purposes. 

In systems where data integrity is important f 
it is desirable that the lockbox be read and programmed 
5 directly by the computer without the use of an 
intermediate key. To insure that this is done, a 
Lockbox Disable On Removal feature is selectably 
provided. 

When the Lockbox Disable On Removal feature is 
10 enabled by appropriate bits in the lockbox 

characterization instructions r the lockbox becomes 
disabled when the shackle is released. In this disabled 
state , the lockbox cannot be operated nor can it be 
reprogramraed from the key. It must be returned to a 
15 stand at a board or agency office for reprogramming. By 
requiring the lockbox be returned for reprogramming, the 
access log can be reliably read for archival purposes, 
-thereby insuring the integrity of the board's lockbox 
database • 

20 

Lockout List 
In certain instances, it may be desirable to 
lock out certain agents, or agents from certain 
agencies, and thereby deny them access to a listed 

25 property. In the preferred embodiment, RAM memory 30 of 
lockbox 12 contains a list of key identification data 
that, although the keys so identified may otherwise be 
authorized, are to be locked out. The identification 
data received from the accessing key is compared against 

30 this list by lockbox CPU 28. If the accessing key's 

identification data corresponds with data found in this 
list, lockbox 12 will refuse to execute any lockbox 
functions requested by the key. 

In the preferred embodiment, there are three 

35 types of lockouts. The first type of lockout identifies 
specific agents that are to be locked out. The second 
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type of lockout identifies specific agencies that are to 
be locked out. 

The third type of lockout identifies a specific 
agency that is to be allowed access to the house key. 
5 Agents from all other agencies are to be locked out. By 
this third type of lockout, a house can be exclusively 
listed by a single agency so that only agents from that 
agency can show the house. 

Each of these lockout functions is implemented 

10 by certain enabling data stored in lockbox RAM memory 30 
with the lockbox characterization instructions. If any 
of these functions is implemented f th3 characterization 
instructions further include data specifying the 
identities of the agents or agencies who are to be 

15 locked out. 



Lockout With Key Disable 
As a further option on the lockout list 
function, lockbox CPU 28 can be programmed to disable 

20 certain locked-out keys that may attempt to execute a 
function on the lockbox- In the exemplary embodiment, 
lockbox CPU 28 responds to each such preidentif ied key 
with a special signal that instructs key CPU 52 to alter 
the key's four digit personal code in key RAM memory 56 

25 by replacing certain digits of this code with 

hexadecimal digits (A-F) which are not included on the 
key's keypad 48. With the personal code so altered, the 
user can no longer arm the key for use. The personal 
code can only be made usable again by reprog ramming the 

30 key, which operation is usually only performed by the 
"supervising real estate board. 

Updating Lockout Lists 
It will be recognized that the lockout list 
35 data stored in each lockbox may need to be updated 
frequently in order to be effective in locking out 
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undesired keys. In one form of the invention, key 14 
has a portion of its RAM memory 56 dedicated to storing 
a lockout list. Stored with this list is a date 
indicating the timeliness of the lockout list data. A 
5 date is also stored with the lockout list data stored in 
lockbox 12 indicating its timeliness. Whenever key 14 
and lockbox 12 communicate, these dates are compared by 
key CPU 52 or lockbox CPU 28. If it is determined that 
the lockout list data stored in key 14 is "fresher" than 

10 that stored in lockbox 12, the key's lockout list data, 
including the date data, is transferred to lockbox RAM 
memory 30 where it overwrites the "stale" lockout list 
data previously stored there. If it is determined that 
the lockout list data stored in lockbox, list 12 is 

15 "fresher" than that stored in key 14, the lockbox's 
lockout list data, including the date data, is 
transferred to key RAM 56 where it overwrites the 
"stale" lockout list data previously stored there. By 
this technique, one unit updates the other so that each 

20 has the newer lockout list data. 

Privacy Read 
Some listing agents, especially those who list 
expensive homes, may wish to prevent others from 
25 retrieving the lockbox access logs recorded in their 

lockboxes. These logs may reveal the identities of the 
agents within the real estate board whose clientele can 
afford expensive homes. This is useful information that 
the listing agent may not wish to share with other 
30 agents. 

In order to maintain the privacy of this 
information, the lockboxes of the present invention can 
be programmed, by an appropriate bit in the lockbox 
characterization instructions, to allow only the listing 
35 agent, or that agent 1 s broker or board, to retrieve the 
lockbox access log. If this enable bit is set, lockbox 
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CPU 28 compares the identification data received from 
the key with its own lockbox identification data before 
allowing an otherwise authorized READ operation to be 
performed. Access to the lockbox access log can thereby 
5 be limited to this authorized class of keys. 

Privacy Shackle Release 
It is generally desirable to restrict execution 
of the SHACKLE RELEASE function to the listing agent, or 

10 to that agent's broker or board* To restrict execution 
of the SHACKLE RELEASE function in this manner , a 
Privacy Shackle Release function is provided. If this 
function is enabled, lockbox CPU 28 compares the 
identification data received from the key with its own 

15 lockbox identification data before allowing a SHACKLE 
RELEASE function to be performed. 

Lockbox Deactivation 
Lockbox 12 can selectively be deactivated to 
20 disable its further use by setting an appropriate 

disable bit in lockbox RAM 30. After being deactivated, 
lockbox 12 must be reinitialized with new 
characterization instructions from the board or other 
supervising authority before it can be used again. 

25 

DIAGNOSTIC FEATURES 
Power -On Diagnostics 
As soon as key 14 is awakened by pressing the 
ON/CLEAR button, a set of diagnostic routines is run to 
30 confirm proper operation of the key. 

As a first check, key CPU 52 determines whether 
the "master software switch" is off. The master 
software switch is a flag in key RAM memory 56 that 
indicates whether the key's characterization 
35 instructions are corrupted. This switch is turned off 
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every time a process of critical loading characteri- 
zation instructions from a computer into the key is 
begun. The switch is not turned back on again until the 
transfer of instructions is completed without error. 
5 If r for example, the key is removed from stand 16 before 
the transfer is completed r the characterization 
instructions in key RAM memory 56 will be incomplete. 
Key CPU 52 recognizes this data corruption by noting 
that the master software switch is still off and 

10 accordingly prevents the key from attempting any 

operations until the characterization instructions are 
loaded correctly. (Provision is made for reloading new 
characterization instructions from a properly authorized 
computer through a stand even when the master software 

15 switch is off) . 

As a second check , key CPD 52 determines 
whether there is any button on keypad 48 that is stuck 
in the down position. 

As a third check, key CPU 52 determines whether 

20 the key is in personal code timeout mode. Personal code 
timeout mode is the ten minute period following four 
unsuccessful entries of the personal code. 

As a fourth check, key CPD 52 performs a 
non-destructive test on key RAM memory 56 to determine 

25 if it is malfunctioning. 

If any of these four error conditions is 
detected, a corresponding error message is presented in 
the message of LCD display 50 for a five second' period 
and the key then returns to sleep. 

30 if none of the error conditions is detected, 

the key then examines the status of the key battery. If 
it needs to be replaced, key CPU 52 makes visible the 
KEY BATTERY annunciator £ or the remainder of the key's 
operations. If the key battery count (discussed below) 

35 is equal to zero, CPU 52 causes LCD display 50 to 
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display the message "DEAD" for a predetermined period of 
time and then go to sleep. 

If the diagnostic tests are run successf ully, 
the key allows the user to proceed and enter the four 
5 digit personal code, etc. 



Error Messages 
The message display portion of the LCD display 
50 can indicate up to 100 errors by displaying messages 

10 ER00 through ER99. The error codes are very finely 

detailed so that a user can determine quite accurately 
the nature of a problem by reference to the two digit 
code. Selected error conditions displayed in this 
manner include pushing a wrong button, dead battery, 

15 wrong personal code, key in personal code timeout mode, 
keyboard button stuck, master software switch off, etc. 

Diagnostic Maintenance Log 
Occasionally, a vendor or manufacturer may 

20 receive reports that a lockbox or key is 

malfunctioning. To aid in investigation of such 
reports, the lockboxes and keys of the present invention 
each have a portion of their RAM memories dedicated to 
storing detailed diagnostic information. In the 

25 preferred embodiment, detailed information on the last 
ten events noted by the lockbox or key microprocessor is 
stored in this "diagnostic maintenance log." Each 
diagnostic maintenance log entry identifies the events 
noted and the key or lockbox unit's response. 

30 The diagnostic maintenance log entry of an 

exemplary OPEN operation in the key might be as 
follows. The key is energized by the ON/CLEAR button. 
If one of the Power-On diagnostics is failed, a 
corresponding entry is made in the diagnostic 

35 maintenance log. Assuming the Power-On Diagnostics are 
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run successfully , the user is allowed to enter the four 
digit personal code. If the wrong code is entered or if 
no code is entered within the ten second time period, a 
corresponding entry is made in the maintenance log. 
5 Assuming the personal code is correctly entered, the 
user is next prompted to select a function. Again, if 
an error is made by the user in selecting a function or 
if the function selected is denied by the system, a 
corresponding entry is made in the maintenance log. 

10 This process of logging any error condition continues 
until the key returns to sleep. 

Although not* recited in the foregoing example, 
it should be noted that an interruption in the 
communications between a lockbox and key is an event 

15 that is always recorded as an entry in the diagnostic 
maintenance log. 

Depending upon the requirements of a particular 
application, each CPU could be programmed to record data 
on all events, or only on those events that prevent the 

20 requested operation from being executed. 

It will be noted that the lockbox access and 
diagnostic maintenance logs of the present invention 
serve two entirely different purposes. The lockbox 
access log serves as a record, for legal or management 

25 information purposes, of a narrow range of lockbox 

operations. The lockbox access log only logs OPEN, SB A, 
SHACKLE RELEASE, SIGNATURE and PILE MARK functions. It 
logs both successful and unsuccessful OPEN, SBA, SHACKLE 
RELEASE and SIGNATURE functions, but only logs PILE MARK 

30 functions if they are successful. If an unsuccessful 
function is logged, no diagnostic data indicating the 
reason for the failure is recorded. With each of these 
access log entries, however, the lockbox logs a variety 
of ancillary data, such as the date and time of the 

35 operation and the identity of the key requesting the 
operation. 
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The diagnostic maintenance log, in contrast, 
serves only as a diagnostic tool. It serves in this 
capacity for all lockbox or key operations, not just 
those four which are of concern to the lockbox access 
log. For each operation, it stores detailed diagnostic 
information. However, no time, date or identification 
data is logged. 

Upon reports of a malfunctioning lockbox or 
key, the corresponding diagnostic maintenance log can be 
retrieved, either by sending the malfunctioning unit to 
the board for coupling to the board computer or by 
coupling the unit to the board computer through a stand 
16. This data can then be evaluated to determine the 
cause of the malfunction. 

Remote Testing 
In addition to retrieving diagnostic 
maintenance log data from keysafes and locks for 
coupling to a computer, stand 16 further serves a 
diagnostic function by enabling a computer to conduct 
detailed testing on a malfunctioning lockbox or key 
unit. A lockbox or key that is malfunctioning can be 
put on a stand and the central board office computer 
called. The central computer can then run a collection 
of diagnostic routines and indicate to the user the 
cause of the problem. If the board's central computer 
is not able to diagnose the problem, the vendor or 
supplier of the equipment can run exhaustive diagnostic 
routines directly from its office to the unit on the 
stand at the remote location. 

AUTHORIZATION OF LOCKBOX OPERATIONS 
The determination of whether a key is 
authorized to operate a lockbox is made by comparing 
certain strings of data exchanged between the lockbox 
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and key. An operation is only authorized if these data 
strings correspond to a specified degree. This process 
is explained in more detail below. 

In the preferred embodiment , the exchange of 
signals between the key and lockbox comprises a 
multipart handshake. First r key 14 sends a first, 
interrogation signal to lockbox 12 to cause the lockbox 
to wake up from its sleeping state. Lockbox 12 responds 
by sending a second signal back to the key. This second 
signal includes lockbox battery condition data and date 
data (provided by the calendar-clock portion of CPU 28) . 

Upon receiving this data, key CPU 52 compares 
the received date data with the key expiration date 
stored in key RAM memory 56 , as discussed earlier. If 
it is determined that the key is " not expired, key CPU 52 
then sends lockbox CPU 28 data identifying the key by 
agent, agency and board so that the lockbox can 
determine whether the requested function can be executed 
on the basis of an ownership match between the lockbox 
and key. Lockbox 12 has corresponding identification 
data, identifying its listing agent, agency and board, 
stored in its RAM memory 30. In order for lockbox 12 to 
authorize execution of the requested function on the 
basis of an ownership match, lockbox CPU 28 compares the 
key identification data received from the key with its 
own lockbox identification data to determine whether 
they correspond to a required degree. The degree of 
correspondence required between these groups of data 
before an operation is authorized is specified by 
"permission codes" stored in the key and sent to the 
lockbox with the key identification "data. 

Permission Codes 
At one extreme, the permission codes may 
require only that the lockbox and key identification 
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data indicate that the lockbox and key are assigned to 
the same real estate board in order for the lockbox to 
authorize the requested operation. At the other 
extreme/ the permission codes may specify that even if 
5 the lockbox and key are assigned to the same board, 
agency and agent , the lockbox will still not authorize 
the requested function. In between these extremes, the 
permission codes may specify that the corresponding 
elements of board and agency identification data match, 

10 or; that the corresponding elements of board, agency and 
agent identification data match, before the lockbox will 
authorize a requested operation . 

Three different permission codes are stored in 
key RAM memory 56 corresponding to three groups of 

15 lockbox operations. The first permission code specifies 
the degree of match required between the lockbox and the 
key identification data before an OPEN, SBA, change SBA 
or FILE MARK function will be authorized. The second 
permission code specifies the degree of match required 

20 between the lockbox and key identification data before 
the SHACKLE RELEASE function will be authorized. The 
third permission code specifies the degree of match 
required between the lockbox and key identification data 
before any of the READ functions will be authorized. 

25 (The remaining functions do not depend on permission 
codes for authorization. CHANGE PERSONAL CODE, CLEAR 
MEMORY and CONTROLLER are functions executed by the key 
alone, not in cooperation with a lockbox. SIGNATURE 
does not require any ownership match for execution. 

30 PROGRAM generally cannot be executed unless there is a 
match between the owner of the computer that loaded the 
programming instructions, into the key and the owner of 
the lockbox.) 

Each permission code can assume one of four 
35 values as follows: 
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4 Disabled 

3 Requires board, agency and agent match 

2 Requires board and agency match 

1 Requires only board match 

5 If lockbox CPU 28 finds the requisite match 

between the lockbox and key identification data, the 
lockbox authorizes and executes the requested function. 
If the lockbox CPU does not find the requisite match, 
the system then examines whether the function might be 
10 authorized based on an "access code" match. 

Access Codes 
If the requested function is OPEN or SB A, key 
14 may authorize the function based on an access code 
15 match. 

Both lockbox 14 and key 12 have at least one 
access code stored in their respective RAM memories, 
(In one form of the invention, up to fifteen access 
codes can be stored in each unit) . The access codes 

20 stored in the lockbox are each three bytes long. A two 
byte field identifies the real estate board. A one byte 
field is arbitrary. The access codes stored in the key 
also contain a two byte field identifying the board and 
a one byte arbitrary field. The .key access codes, 

25 however, each additionally contain an expiration date 
field. If the requested function is an OPEN or SBA 
function and if the function was not authorized by a 
permission-code specified ownership match, the lockbox 
transmits its access codes to the key for evaluation by 

30 key CPU 52. 

After receiving the lockbox access codes, key 
CPU 52 compares each of the lockbox access codes with 
each of the key access codes stored in key RAM 56. If 
key CPU 52 finds a match, it then compares the 

35 expiration date associated with the matching key access 
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code with the date data received earlier from the 
lockbox to determine whether the key access code 
involved in the match is nonexpired. If the code is 
nonexpired, the key sends the lockbox a signal 
5 instructing the lockbox to execute the requested OPEN or 
SBA function. 

If none of the key access codes matches any of 
the lockbox access codes , or if only expired key access 
codes match lockbox access codes, the key sends the 

10 lockbox a signal instructing the lockbox not to execute 
the requested OPEN or SBA function. 

Summarizing the procedure by which a function 
is authorized , if the requested function requires a 
permission code-specified ownership match and such match 

15 is found , the lockbox authorizes the requested 

function. If the requested function is an OPEN or an 
SBA and if the permission code-specified match is not 
found , the key can nonetheless authorize the function if 
any of the lockbox access codes match any of the 

20 nonexpired key access codes. 

It should be noted that the particular function 
authorization process described above was adopted 
because it minimizes the amount of data transmitted 
between the lockbox and key units and because it made 

25 the most efficient use of the processing and memory 
capabilities of the respective units. However , the 
elements of data exchanged and the distribution of the 
decision making tasks between the two CPUs could readily 
be altered to meet the requirements of other 

3 0 appl ica t ions . 

Segmentat i on/Reg ional i zat ion 
The access code system of the present invention 
provides several capabilities that have been difficult 
35 or impossible to implement in prior art lockbox 



WO 87/05069 



PCT/US87/00374 



- 50 - 

systems. One such capability is board segmentation and 
regionalization. 

In a typical system, the arbitrary byte 
included in the lockbox and key access codes is used to 
5 segment or regionalize the properties listed by a real 
estate board into a variety of classes. For example, a 
board may deal in both residential and commercial 
properties, but not want residential agents to gain 
access to commercial listings and vice versa. In this 

10 case, the arbitrary byte in the lockbox access codes of 
the lockboxes installed on commercial properties could 
be set to "1" and the arbitrary byte in the lockbox 
access codes of lockboxes installed on residential 
properties could be set to w 2." The keys of commercial 

15 agents would then be programmed to have an access code 
terminating in "1/ while the keys of residential agents 
would be programmed to have an access code terminating 
in w 2. n With the access codes so set, residential 
agents would be prevented from gaining access to 

20 commercial properties and vice versa. 

Inter-Board Cooperation 
In addition to enabling real estate boards to 
segment and regionalize their listings, the access code 

25 system of the present invention also enables real estate 
boards to cooperate in the sales of properties. For 
example. Board A may wish to allow all agents from 
neighboring Board B to have access to a lockbox on a 
particular house within Board A territory in order to 

30 expedite its sale. To do this, Board A would add to 
this lockbox's access code list an additional access 
code comprised of two bytes identifying Board B, 
together with the one byte arbitrary field that is in 
general use by Board B. By so doing, Board A enables 

35 all agents from Board B to open the lockbox with their 
existing Board B keys . 
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Similarly , an agent (c) from Board C may wish 
to show a client houses listed for sale in neighboring 
Board D. To do this f agent (c) would call Board D and 
request that it load an access code into agent (c) f s key 
5 that matches the access code (or codes) resident in the 
Board D lockboxes to which agent (c) seeks access . (A 
board can only load a key with key access codes having 
that board's identifying two byte field). The loading 
of these access codes could be done by Board D v s 

10 computer over telephone lines into agent (c)'s key via a 
stand, regardless of the distance between Boards C and 
D. Board D would doubtless also append an expiration 
date to the codes loaded into agent (c)'s key so that 
agent (c) could only access the properties in Board D 

15 for a limited period, such as a day or two. 

Additional Information on Permission Codes 
Like the access code system described above, 
the permission code system also gives the present 

20 invention capabilities that were difficult or impossible 
to implement in prior art lockbox systems. For example, 
the permission code system enables keys to be delegated 
different capabilities corresponding to the needs and 
privileges of different users. 

25 As noted, each key is programmed with 

permission levels for three different classes of 
functions: OPEN/SBA, SHACKLE RELEASE and READ. In 
operation, the permission levels indicate the degree of 
ownership match required between a key and lockbox 

30 before the two units can cooperate to execute a function. 

The different permission codes in a key are 
assigned independently of one another, so that a key can 
have one permission code for certain functions and 
different permission codes for other functions. This 

35 feature allows boards and agencies to vary the 
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capabilities of their keys simply by reprogramming the 
permission codes stored with the key characterization 
instructions. Such specialized keys have several 
applications • For example , an agency may wish to hire a 
5 courier to visit various houses listed by the agency to 
retrieve the lockbox access logs. However, the agency 
may not want the courier to have access to the key 
compartments of any of these lockboxes. To limit the 
courier's capabilities in this manner , the agency puts 

10 the key in the stand and sets the permission codes for 
OPBN/SBA and SHACKLE RELEASE to 4. A permission code of 
4 prevents the function from being executed , regardless 
of the degree of ownership match between the lockbox and 
key. The READ permission level is set to 2, which 

15 allows the key to read the lockboxes on all the houses 
listed by the agency. The courier can then go and 
retrieve data from all these lockboxes and yet be unable 
to gain access to any of the house keys. 

As far as the permission levels are concerned r 

20 there is no distinction made between listing agents and 
nonlisting agents. A permission code of 3 is generally 
assigned to each. However , listing agents can perform 
significantly more functions at a lockbox than a regular 
agent. For example , listing agents can change the Shown 

25 By Arrangement code and can execute Privacy Reads. 

These privileges , however , are not granted by reference 
to permission codes in key RAM 56. Instead f such 
restricted functions are authorized only when CPO 28 or 
CPU 52 has confirmed that the key requesting execution 

30 of the function is owned by the listing agent associated 
with the lockbox (or that agent's broker or board). If 
no such match is found , the key owner is refused 
authorization to execute the listing agent functions. 



35 
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Industrial Applications of Permission Codes 
The permission code system of the present 
invention has applications in the industrial security 
market as well as in the real estate lockbox field. An 
industrial site can be tiered in a manner analogous to 
the agent , agency and board levels used in lockboxes. 
For example , an industrial site could be tiered into 
employee , building master and site master levels. The 
employees of a company could be assigned permission 
codes of 3, allowing them to unlock only the doors for 
which they are the responsible employees. Building 
security guards could be assigned permission codes of 2, 
allowing them to unlock all doors in the particular 
buildings for which they are responsible. Master 
15 security guards could be assigned permission codes of l f 
allowing them to unlock all doors on the site. 

Permission Codes and Computers 
The permission code system of the present 

20 invention is also used with computers 18. Each computer 
is assigned a permission code that specifies which 
lockboxes and keys it can work with. If the computer 
belongs to an agency, it will be assigned a permission 
code of 2. A computer with a permission code of 2 can 

2 5 only be used to interface, through a stand, with keys 
and lockboxes assigned to that same agency. If the 
computer is owned by the board, it will be assigned a 
permission code of 1 and can be used to interface with 
all keys and lockboxes in the real estate board. 

30 The permission code assigned to a computer also 

limits the authority it can delegate to a key. A 
computer can delegate different levels of authority to a 
key by the permission codes that it loads into the key 
with the characterization instructions. A computer can 

35 reprogram a key's permission codes to the computer's own 
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permission code or to any more restricted level. For 
example f a computer owned by an agency can reprogram a 
key to have permission codes of 2, 3 or 4. Such a 
computer cannot be used to program a key to have 
5 permission code of 1, for this would be delegating 
authority to the key higher than the computer's own 
authority. A board level computer f due to its 
permission code of 1/ can be used to program or read any 
lockbox or key owned by the board. 

10 

COMMUNICATIONS 
Digital Reconstruction Modulation 
As noted, communication between the lockboxes , 
keys and stands of the present invention is effected by 
15 electromagnet ically coupled coils. In the prior art, 
exchange of data over coupled coils was effected by 
modulating the data signal onto an audio frequency or 
radio frequency carrier-. Such electromagnetic coupling 
has previously been poorly suited for use in such 
20 battery powered applications because the modulated 
carrier draws a relatively large amount of power from 
the battery. 

In order to minimize battery drain, the present 
invention employs a new modulation scheme, termed here 

25 "digital reconstruction modulation." In this system 
(Pig. 19), the raw data signal which is switching, for 
example, between zero volts and two volts, is applied 
directly across a first, transmitting coil 300. Across 
a second, receiving coil 302 is induced an alternating 

30 series of positive and negative transient voltage spikes 
corresponding to the transitions in the data signal. 
These transient voltage spikes are applied to a Schmidt 
trigger circuit 304. The Schmidt trigger circuit 
toggles states only when the voltage applied to its 

35 input is above a first threshold voltage or below a 
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second threshold voltage . These threshold voltages are 
selected so that the positive transients exceed the 
first threshold voltage and so that the negative 
transients drop below the second threshold voltage. The 
5 positive transients thus cause the Schmidt trigger to 
toggle on and the negative transients thus cause the 
Schmidt trigger to toggle off. The output signal 
provided by the Schmidt trigger is thus identical to the 
data signal applied to the transmitting communications 

10 coil, reconstructed by virtue of the Schmidt trigger's 
hysterisis properties. 

Depending on the relative orientation of the 
two communicating coils, a low to high data signal 
transition applied across the first coil may cause a 

15 positive or a negative voltage transient across the 
second coil. Thus f the data signal recovered by the 
Schmidt trigger may be the inverse of the data signal 
applied to the first coil. This detail can be taken 
care of by starting the exchange of data between system 

20 units with a known data string. If the CPU in the 
receiving unit detects that the known data string is 
inverted, it can cause the output from the Schmidt 
trigger to be inverted again, bringing the signal back 
to its proper condition, for the remainder of the 

25 communications. Alternatively, the problem of data 
inversion can be eliminated entirely by insuring that 
the communicating components are always coupled in the 
desired orientation. 

One advantage of this digital reconstruction 

30 modulation is that the effective range over which the 
coupled coils can communicate is not, as in the prior 
art, determined by the current drawn by the transmitting 
coil. Instead, the strength of the received signal- is 
dependent solely on the rise time and fall time of the 

35 input data signal and on the coefficient of coupling 
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between the transmitting and receiving coils. The 
voltage induced in the receiving coil is proportional to 
the time rate of change of this input signal. Thus, 
limiting the current in the transmitting coil, for 
5 example by a current limiting circuit set to clamp the 
coil current at one milliarapere, does not significantly 
reduce the communications range. Range is only limited 
by the switching speed of the component logic. 

A second advantage is tBat the data 
10 transmission rate is not limited by the frequency of a 
carrier signal carrying the data. Again, the only 
limits imposed are by the switching speeds that can be 
obtained in the coil circuit. 

15 Adaptive Communications 

The maximum speed at which lockbox, key and 
stand components can communicate with one another varies 
as a function of temperature, component tolerances and 
component aging. In a worst case situation, one system 
20 component might be able to communicate at only one-third 
the speed of another component. Instead of using a 
communication speed that is certain to be within the 
capability of all system components (i.e. the lowest 
common denominator speed) , the present invention employs 
25 an adaptive communications scheme that optimizes the 
communications rate for a particular pair of 
communicating components. 

As noted earlier, communications between units 
are generally begun by the key sending an interrogation 
30 signal to wake up the lockbox. Before' the lockbox 
responds with its response signal identifying the 
lockbox r reporting on battery state, etc., as discussed 
earlier, the two units first agree on a data 
transmission speed. 
35 To set the data transmission speed, each unit 

sends the other its shortest data element. In the 
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present invention f a data 0 is represented by a signal 
duration of a first period and a data 1 is represented 
by a signal three times longer. To set the data 
transmission speed , the key thus sends to the lockbox a 
5 data 0 at the key's top speed. Lockbox CPU 28 measures 
the duration of this signal and stores this value in its 
RAM memory 30. Lockbox CPU 28 then sends the key a data 
0 signal at the lockbox's top speed. Key CPU 52 in turn 
counts the duration of this signal and stores this value 

10 in its RAM memory 56. CPUs in both units then compare 
the duration of the signal received with the duration of 
the signal they sent in order to determine which unit is 
operating more slowly. The CPU in the faster unit then 
reduces its data communications speed in order for the 

15 length of its data 0 to match that of the slower unit. 
(The speed at which each unit transmits is set by a data 
word in the unit's RAM memory , which word can be altered 
by the CPU to effect the speed change) . By this 
technique, the two units adapt to operate at the highest 

20 speed that both units can manage. 

After two communicating units agree on a data 
transmission speed f they then exchange bits of data, 
such as the data 0 signal , alternately, approximately 20 
times r in order to confirm that a reliable 

25 communications link has been established. If these 

twenty exchanges of data 0 signals are completed without 
interruption, the communications link is considered to 
be reliable and the exchange of function authorizing 
data between units is begun. 

30 

BATTERY SYSTEMS 

A comprehensive battery monitoring system is 
employed in the present invention to prevent the lockbox 
and key batteries from failing and rendering the 
35 associated units inoperative. The battery monitoring 



WO 87/05069 



PCT/US87/00374 



- 58 - 

systems rely on three independent criteria to determine 
when each battery is nearing the end of its useful life: 
elapsed time, usage and current drain from the backup 
battery. When the lockbox or key CPU detects either of 
5 the first two of these three low battery criteria, it 
loads a battery count number, such as 16, in its 
memory. (When the CPU detects the third low battery 
criteria, it immediately loads a battery count of zero 
in its memory) . This battery count number is then 

10 decremented each time a lockbox or key operation is 
performed. The battery count represents the number of 
additional operations that the lockbox or key will 
perform before it curtails operation. 

If the lockbox battery is low, the key informs 

15 the user of this condition just before the key returns 
to sleep. Each time the lockbox and the key 
communicate, the lockbox indicates to the key the status 
of the lockbox battery. If any of the three low battery 
criteria have been met, the lockbox relays the lockbox 

20 battery count to the key, which in turn displays this 
number in the message portion of its LCD display 50 and 
makes visible the KEYSAPE BATTERY annunciator in the top 
portion of the LCD display. The key then beeps to call 
the user's attention to the display. The number 

25 displayed in LCD 50 is the number of additional lockbox 
operations that the lockbox will allow before it 
curtails activities to prevent battery failure. The key 
maintains this LCD display for approximately two minutes 
before going to sleep. 

30 in alternative embodiments, the lockbox battery 

count is not displayed on the key's LCD display. 
Instead, the KEYSAFE BATTERY annunciator and the beeper 
alone are used to warn the user that the lockbox will 
soon curtail its operations. By not informing the user 

35 of the precise number of lockbox operations left, it is 



WO 87/05069 



PCT/US87/00374 



• 59 - 

hoped that the user will replace the lockbox battery 
without delay. 

If the key battery is low, the user is reminded 
by the KEY BATTERY annunciator. Each time the key is 
5 powered on by the ON-CLEAR button f key CPU 52 examines 
the portion of key RAM memory 56 in which the key 
battery count is stored. If key CPU 52 finds a count, 
the count is decremented and the KEY BATTERY annunciator 
is made visible and remains visible for the duration of 
10 the key's operation. 

For expository convenience, the following 
discussion of the three low battery criteria focuses on 
the lockbox battery monitoring system. The key battery 
monitoring system is analogous. 

15 

First Low Battery Criterion 
The first low battery criterion is elapsed 
time. When a new battery is installed in the lockbox, a 
date counter is started that increments each day or 

20 other set period. The first low battery criterion is 
met when this count reaches a predetermined value, such 
as three years. That is, the system presumes that the 
lockbox battery is nearing the end of its useful life 
when it is three years old. 

25 The predetermined time period at which the 

battery is assumed to be nearing the end of its useful 
life can be chosen to correspond to the particular 
circumstances of the lockbox. For example, if the 
lockbox is used in a cold environment, such as in 

30 Alaska, its "shelf life" will be longer than if it is 
used in southern Florida. Similarly, the predetermined 
period can be chosen to correspond to the type of 
battery installed. If alkaline batteries are used, the 
predetermined period would be set to a longer period 

35 than if conventional carbon batteries are used. 
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Replacement of the primary battery in the unit 
is detected by lockbox CPU 28 which monitors the voltage 
of the primary battery. When this voltage is 
interrupted and then restored, lockbox CPU 28 assumes 
5 that the battery has been replaced and resets the date 
counter accordingly. In an alternative embodiment , 
lockbox CPU 28 is informed of the removal and subsequent 
replacement of a primary battery by a microswitch 
positioned in the lockbox battery compartment. 

10 

Second Low Battery Criterion 
The second low battery criterion is battery 
usage. When a new battery is installed in the lockbox , 
a battery capacity number is stored by lockbox CPU 28 in 

15 RAM memory 30. This number represents, very 

conservatively, the total estimated capacity of the 
battery. Each time an operation is performed, this 
number is decremented by a number representative of the 
energy actually consumed. The second low battery 

20 criterion is met when this battery capacity number 
reaches zero. 

The battery capacity number loaded into RAM 
memory 30 when the battery is replaced could again be 
chosen to correspond to the particular circumstances of 

25 that lockbox* For example, if the lockbox is used in a 
cold environment, its battery will be less able to 
deliver successive large current loads than if it is 
used in a warm climate. 

The amount by which battery capacity number is 

30 decremented is a function of the particular operations 
performed and their duration. In an exemplary lockbox 
system, the operations can be grouped into three 
classes: operation of a pair of locking solenoids, 
operation of the communications coil and operation of 

35 the remainder of the circuitry. Each of these 
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operations is considered by lockbox CPU 28 to consume 
energy at a fixed rate. A pair of locking solenoids may 
be considered to consume energy at a rate of 3 watts f 
the communications coil at a rate of 5 milliwatts and 
5 the remainder of the circuitry at a rate of 1 
milliwatt. Each time any of these operations is 
performed , CPU 28 operates a corresponding timer to 
measure its duration. The measured duration of each 
operation is multiplied by its assumed energy 

10 consumption rate to estimate the amount of energy 

actually withdrawn from the battery. These measures of 
energy usage are then subtracted from the battery 
capacity number stored in RAM memory 30 to provide an 
indication of the battery energy remaining. As noted, 

15 the second low battery criterion is met when this 
battery capacity number is decremented to zero. 

In an alternative embodiment/ the second low 
battery criterion is simply the number of operations 
performed by the lockbox. When a new battery is 

20 installed, a second counter f this one an operations 

counter, is started. This operations counter counts the 
number of high power operations (i.e., lockbox 
operations that energize solenoids, such as OPEN and 
SHACKLE RELEASE) performed by the lockbox. The second 

25 low battery criterion in this alternative embodiment is 
met when this operations counter reaches 1000. That is, 
the system presumes that the lockbox battery is nearing 
the end of its useful life after 1000 high power 
operations have been performed. 

30 

Third Low Battery Criterion 
Both of the above two low battery criteria 
assume that the battery installed is new and functioning 
properly. However, in the event that a used or faulty 
35 battery is installed, a third low battery criterion is 
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considered. The third low battery criterion is current 
drain from the backup battery. 

Normally , no current is drawn from lockbox 
backup battery 34. The backup battery only supplies 
5 current when primary battery 32 is not able to meet all 
the lockbox's power requirements. When lockbox CPU 28 
detects that current is being drawn from backup battery 
34 , this third low battery criterion is met and the 
system presumes that the primary battery is at the end 
10 of its useful life. In this instance , unlike the 

preceding two, the battery count number is immediately 
set to zero so that any energy remaining in the primary 
battery can be preserved for a SHACKLE RELEASE operation. 

15 Additional Details on Battery Systems 

As noted, once either of the first two low 
battery criteria has been detected, a counter is set to 
an arbitrary number, such as 16, and is decremented each 
time an additional lockbox operation takes place. This 

20 count begins at a relatively low number, such as 16, 

rather than at a higher number because if the number is 
too high, users will likely ignore it for too long. 

In alternative systems, the battery count could 
increase. However, it has been found that users rarely 

25 remember what the top number is, but always know what 
zero means. 

If the lockbox battery count reaches zero (or 
is set to zero by detection of current drain from the 
backup battery) , OPEN and SBA functions are denied to 

30 everyone except keys owned by the board itself, as 

determined with reference to a permission code of 1 in 
the key. At this point,, the lockbox is of little 
utility. Other operations are similarly prevented, such „ 
as FILE MARK, SBA and change SBA. However, the 

35 remainder of the functions, including SHACKLE RELEASE, 
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can still be performed, thereby allowing the listing 
agent (or the listing agent's broker or board) to remove 
the lockbox and replace the batteries. In the preferred 
embodiment/ after the lockbox battery count reaches 
5 five, the lockbox control software will only allow the 
listing agent (or the listing agent's broker or board) 
to execute the OPEN or SBA function. 

The low battery criteria and associated 
numerical constants discussed above are selected so that 

10 even when the battery count reaches zero, the battery 
still has approximately half of its capacity left. This 
reserve capacity insures that the high power SHACKLE 
RELEASE function can still be performed. The lockbox 
battery capacity is prevented from draining much below 

15 this point by preventing high power OPEN functions. 

Backup Battery Monitoring 
In one form of the invention, the backup 
batteries in the lockbox and in the key are also 

20 monitored so as to determine when they are nearing the 
ends of their useful lives. In an exemplary embodiment, 
each lockbox and key includes a software timer that 
counts the time elapsed during which the backup battery 
is the sole power source for the unit, such as when the 

25 primary battery has been removed. When this timer 

reaches a predetermined count, an appropriate warning 
message is displayed in the message portion of key LCD 
display 50 indicating that the appropriate backup 
battery should be replaced. 

30 In alternative embodiments, more complex backup 

battery monitoring schemes, such as those used with the 
primary batteries, can be employed. 



35 



RADIO UPDATING 
In one form of the invention, data in lockboxes 
and keys throughout the real estate board can be updated 
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by radio. By this technique , both board-wise changes of 
data, such as changes of lockout lists and access codes, 
and changes targeted to specific units, such as 
disabling a particular key, can be implemented simply 
5 and quickly. 

For expository convenience, the following 
discussion focuses on radio updating of lockboxes. 
However, an analogous system can similarly be employed 
for radio updating of keys. 

10 In systems employing radio updating, the data 

to be loaded into the memories of the lockboxes is 
modulated onto a subcarrier transmitted with a 
conventional FM broadcast • The source of the data can 
be a conventional modem driven from board computer 18. 

15 A receiver in each lockbox decodes this data from the 

modulated subcarrier and reloads its memory according to 
these instructions. 

In more detail, the signals broadcast by FM 
stereo radio stations have a bandwidth of 200 kilohertz, 

20 100 kilohertz on each side of the carrier frequency. 

The FM stereo audio and stereo pilot occupy the spectrum 
from the carrier frequency out 53 kilohertz each side. 
The portion of the spectrum from 53 to 100 kilohertz on 
either side of the carrier is vacant and is presently 

25 being used for a variety of other subcarrier services, 
such as transmission of commercial free music, 
educational materials and stock market reports. In the 
present invention, the data from board computer 18 to be 
sent to the individual lockboxes is modulated on a 

30 subcarrier positioned at 76 kilohertz in the FM baseband 
signal, approximately midway in this vacant range of 
frequencies. Referring to Fig. 20, the digital data 
from the board computer 18 is provided to' a subcarrier 
generator 200 connected to an exciter 202 of the FM 

35 transmitter 204. The subcarrier generator generates the 
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76 kilohertz subcarrier signal which is modulated with 
the data. 

This modulated FM signal is received by a 
receiver 206 in each lockbox. The received FM signal is 
5 fed from an antenna 208 (discussed below) to a mixer 210 
through an RF preselector/attenuator circuit 212. RF 
preselector/attenuator circuit 212 provides some 
attentuation of out of band signals while amplifying the 
desired signals r thereby minimizing the receiver f s noise 

10 figure. Mixer 210 mixes the desired FM broadcast signal 
received by antenna 208 with a local oscillator signal 
from a local oscillator 214. The frequency of local 
oscillator 214 is selected to produce an up-converted 
first intermediate frequency (IF) of 384 megahertz. 

15 The output from first mixer 210, including the 

384 megahertz IF, is fed to an IF section 216. IF 
section 216 includes a first filter 218 which passes the 
desired 384 megahertz signal and rejects the unwanted 
mixer products. Filter 218 desirably comprises a 

20 surface acoustic wave filter. The output from filter 
218 is fed to a second mixer 220. Second mixer 220 
mixes the signal from filter 218 with the signal from a 
second local oscillator 222. Second local oscillator 
222 provides a 394.7 megahertz signal, thereby yielding 

25 a down-converted second receiver intermediate frequency 
of 10.7 megahertz. The output from second mixer 220 is 
fed to a second filter 224 which attenuates the 
undesired mixer products and passes the 10.7 megahertz 
signal to IF amplifier circuit 226. Second filter 224 

30 can be a standard 10.7 megahertz ceramic filter of the 
type commonly used in FM receivers. 

IF amplifier 226 amplifies the 10.7 megahertz 
signal from filter 224 to a level suitable for detection 
by a phased lock loop detector circuit 228. Detector 

35 228 demodulates the IF signal and provides a wideband 



WO 87/05069 



PCT/US87/00374 



-66 - 

composite audio signal to an SCA band pass filter 230. 
SCA band pass filter 230 passes the desired subcarrier 
channel to an SCA decoder 232, while attenuating the 
lower frequency audio components. Decoder 232 
5 demodulates the filtered SCA channel and provides the 
demodulated audio to a modem circuit 234 that converts 
the modem signals originally encoded on the subcarrier 
back to digital data form. The output from modem 234 is 
treated just as any other data input to the lockbox, as 
10 for example through the communications coil, and is used 
to effect the reprogramming of the lockbox RAM memory 
30. 

In certain embodiments, antenna 208 can include 
lockbox shackle 22 as its principal component. In such 

15 cases, shackle 22 is insulated within the case to 
prevent it from contacting the lockbox's electrical 
ground and is similarly insulated outside the case, as 
by an insulating vinyl rain guard enclosing the shackle, 
to prevent it from contacting the structure to which is 

20 is fastened. Although the shackle is a small antenna, 
it can be resonated by preselector/attenuator circuit 
212 so as to operate as a low impedance resonant antenna 
at the frequency of interest. 

In some lockbox mounting positions, such as on 

25 a grounded water faucet, the electrical coupling between 
the shackle antenna and ground may be sufficient, 
despite any intervening insulation, to reduce the 
strength of the received signal to a point at which it 
cannot be decoded reliably. Accordingly, it is often 

30 desirable to use an antenna that does not include the 
shackle as a principal element. Such an antenna may 
take the form of a planar coil encased in plastic and 
mounted on an exterior surface of the lockbox. Such an 
antenna can also be used on or in a radio-updated key. 

35 in still another form of the invention, antenna 

208 can comprise an insulated conductor wound about 
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shackle 22 so as to form a helically loaded loop. 

Because the radio updating process involves 
alterations to the lockbox memory/ it is desirable that 
the updating not be interrupted by requests from keys to 
operate the lockbox. Consequently, it is desirable that 
all lockbox updating be done between the hours of 
midnight and 6:00 a.m., a period during which the 
lockboxes would not normally be in use. Each lockbox 
can be programmed to energize its receiver circuitry for 
this or any other predetermined period every night to 
listen for updates from the board office. This window 
period can be a few minutes long or a few hours long. 
Data sent from the central board office can be directed 
to all the lockboxes, or can include an introductory 
address data string identifying a particular lockbox to 
which the data is targeted. In either event, the 
transmissions from the board office can additionally 
include a reference time signal so that all lockboxes 
are synchronized in their operations and so that they 
•will activate their receivers at the same time every day. 

By using such a radio updating approach, 
maintenance of lockbox and key data is greatly 
facilitated and system performance is thus enhanced. 

25 SYSTEM MANAGEMENT 

Some large real estate boards have tens of 
thousands of lockboxes and keys in their systems, so an 
integrated management system is virtually essential. In 
one embodiment of the invention, a tnultiuser f 

30 multitasking system with large amounts of on-line 

storage is resident at the board office and serves as 
board computer 18. A super microcomputer such as the 
NCR Tower system is a suitable machine. 

As shown in Fig. 21, a computer system for a 

35 large real estate board desirably includes a trunk 
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interface unit 94 and a plurality of telephone lines 96 
to allow a plurality of remote stands 16b (not shown) to 
interface with the super microcomputer simultaneously. 
In the preferred embodiment, up to eight telephone lines 
5 are used. Trunk interface unit 94 thus allows super 
microcomputer 18 to be interrogated over telephone lines 
(using DTMF tones) and allows data to be exchanged 
between the super microcomputer and individual lockbox 
and key components via stands 16. In such capacity, 

10 stands 16 function as remote input/output ports for the 
board computer and the stands 1 microprocessors function 
as smart input/output controllers. 

In the preferred embodiment, trunk interface 
unit 94 includes an interface module 99 associated with 

15 each telephone line 96 for decrypting incoming data and 
for encrypting outgoing data. Modules 99 also desirably 
include speech synthesizers so that synthesized speech 
corresponding to various computer data can be sent back 
to individual agents over the telephone lines. A ninth 

20 interface module 99, which does not include a speech 
synthesizer, is provided in trunk interface unit 94 for 
interfacing with a local stand 16a resident at the board 
office. 

Board computer system 18 also desirably 
25 includes at least one phone line 98 and an associated 
data modem 97 for interfacing to smaller computers 18 
resident at individual agency offices. 

In a typical large system, several smaller 
computers 18 are distributed throughout the system. 
30 Normally, such smaller computers are limited to 

performing certain preselected functions. For example, 
the software loaded into a small computer 18 at an 
individual agency typically enables it to update certain 
lockbox parameters, such as changing the lockout list 
35 and changing the daily disable times, but prevents it 
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from changing more sensitive parameters, such as lockbox 
access codes. Similarly, the software loaded into the 
small computer 18 at the agency typically enables it to 
deactivate keys, but prevents it from reinitializing 
5 keys after they are deactivated and prevents it from 
changing key expiration dates and expired key access 
codes. Such restricted functions can only be performed 
by the central board computer. 

The board computer is used to keep track of all 

10 data pertinent to the system. Whenever a key or a 

lockbox is read or programmed, the corresponding data is 
entered into a system database. This database includes 
information on all the features and parameters 
heretofore mentioned, for every lockbox and key in the 

15 system. The board computer can search the database for 
any category of information and can generate 
corresponding written reports on any such subject. By 
such reports, the board can better target* its 
activities. For example, the board can search the 

20 database to determine which listed properties have not 
been shown often and then suggest to the member agencies 
that the advertising of .these properties be increased. 
Similarly, the board can monitor manpower trends and 
suggest staffing schedules that allocate agents to the 

25 offices and at the times that the demand is greatest. 

The above described system offers many 
advantages to real estate boards that span large 
territories. For example, keys 14 are usually 
programmed to expire occasionally and must be 

30 rejuvenated. This is desirably done by the real estate 
board, rather than by the individual agencies, so as to 
maintain centralized control over key usage. 
Accordingly, as noted, most small computers resident at 
the various agencies are not able to rejuvenate expired 

35 keys. The agents could travel to the board office 
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periodically to have their keys rejuvenated, but in 
large metropolitan areas this may be burdensome. The 
present system allows agents to complete all such 
transactions with the board computer over telephone 
5 lines. To rejuvenate an expired key, for example, the 
agent would place the key on a stand 16 and would call 
the board computer. The key could then exchange 
appropriate handshaking signals with the computer and 
receive from the computer the key characterization 

10 instructions needed to rejuvenate the key. 

In addition to enabling the board computer to 
communicate with smaller agency computers, phone line 98 
also permits the board computer to communicate with the 
vendor. Updated software can be reloaded using this 

15 link. Other diagnostic routines, such as one for 
analyzing a diagnostic maintenance log stored in a 
lockbox or a key, can be executed by the vendor on 
individual components by using this link to couple 
through the board computer to the individual components 

20 at local board or agency offices. 

The board computer includes several security 
features. For example, all requests for service to the 
computer must include proper password codes before any 
transactions are allowed. Certain particularly 

25 sensitive transactions may require that a user call the 
board computer, send appropriate passwords and then hang 
up. The board computer then calls the user back on a 
predetermined telephone line. By this and other 
techniques, security of the system can be maintained 

30 even if the security of the password*codes is breached. 
As will be recognized from the above 
discussion, the addition of a centralized board computer 
and its associated equipment greatly increases the 
system's utility and provides large real estate boards 

35 with a versatile , comprehensive and integrated lockbox 
management system. 
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Initialization and Deactivation 
of Lockboxes and Keys by the Computer 
When the lockboxes and keys of the present 
invention are initially shipped from the vendor, they 
5 are not assigned to one particular real estate board. 
That is, the board identifying data portion of each 
unit's RAM memory is left unprogrammed. This field is 
later programmed automatically when the unit is 
initialized by a computer. 9 

10 Both the lockboxes and the keys of the present 

invention include a bit, termed here the "free agent 
bit," in their respective RAM memories that indicates 
whether the unit has been assigned to a particular 
board. This bit is initially set to n 0 w by the 

15 manufacturer , indicating that the unit is unassigned. 

When the unit is received by the purchaser, it 
is placed on a stand and initialized by an 
initialization routine run on a computer coupled to the 
stand. One of the first operations performed by this 

20 initialization routine is to determine the status of the 
unit's free agent bit. If it is found to be "0," the 
routine automatically stores in the unit's RAM memory a 
string of data identifying the board to which the 
computer itself is assigned. The computer then changes 

25 the unit's free agent bit from a "O" to a "1/ thereby 
preventing subsequent changes of the lockbox's or key's 
board ownership. By this technique, every lockbox and 
key is assigned automatically to the board to which the 
programming computer is assigned. 

30 After the lockbox or key is assigned to the 

initializing board, as described above, the 
initialization routine in computer 18 continues by 
loading the unit's RAM memory with characterization 
instructions as specified by the programming entity, 

35 usually the real estate board. 
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After a lockbox or key has been initialized , it 
can then only be reprogranraied by computers assigned to 
the same board. If it is desired to transfer a lockbox 
or a key to a different board, the original owner must 
deactivate the unit and change the unit's free agent bit 
back to "0." Thereafter, the unit will again assume the 
board ownership of the computer that reinitializes it* 

Fraud Deterrence 

The database in the board's central computer 18 
includes data identifying each lockbox and key in the 
system and its operational status (initialized, 
deactivated , etc.). This data is used by the computer 
to prevent keys from being fraudulently duplicated. 

As noted, each key includes identification data 
indicating the key's ownership by agent, agency and 
board. Computer 18 will not load a key with a set of 
identification data if it determines that a key having 
that particular set of identification data already 
exists. The system thus prevents an unscrupulous user 
from reprogramming his or her key so as to fraudulently 
assume the identity of another agent in the board. The 
only way an unscrupulous agent could perpetrate this 
fraud would be to first obtain possession of the other 
agent's key and to deactivate it. This function, 
however, cannot generally be executed without knowledge 
of the other agent's personal code, which the 
unscrupulous agent should not know. Thus, it will be 
recognized that the database's tracking of data on each 
key in the system serves an important role in deterring 
fraud. 

MECHANICAL CONSTRUCTION OP LOCKBOX 
With reference to Pig. 3, lockbox 12 includes 
shackle 22 f case 100 and a hinged key compartment door 
24. Door 24 is retained in the closed position by a 



WO 87/05069 



PCT/US87/00374 



- 73 - 

cooperating door latch 102 and door stem 104* Door stem 
104 is shown in Pig. 6 as including a hook portion 106 , 
a butt portion 108 and a turned cut portion 110. Stem 
104 is spring biased away from the back of case 100 by a 
5 spring 112 compressed between case 100 and a shoulder 
114 on stem 104* Door stem 104 is retained in the 
locking position by the plungers 116, 118 of key 
compartment locking solenoids 36 (Pig. 2) which engage 
stem 104 at turned cut portion 110 and limit its forward 
10 travel. 

When it is desired to open door 24, the door is 
pressed inwardly. This causes door stem 104 to move 
towards the rear of the case. This freedom of movement 
of stem 104 is provided by the length of turned cut 

15 portion 110, which allows the stem to move inwardly 

while still engaged with the extended solenoid plungers. 

After door stem 104 has been moved inwardly a 
distance, a retaining pin 120 is urged against a pivoted 
lever 122. Lever 122 pivots about a pivot point 124 

20 connected to the case, thereby causing the opposite end 
of the lever to exert a force against an actuator button 
126 on microswitch 42. When microswitch 42 closes, key 
compartment locking solenoids 36 energize, provided the 
appropriate authorization signals have been exchanged 

25 between the lock and key. 

When key compartment locking solenoids 36 
energize, their plungers 116 , 118 retract. When the 
plungers retract, locking stem 104 is allowed to travel 
forwardly, no longer bound by the engagement of the 

30 plungers in the turned cut portion of the stem. Thus, 
when the user releases the door, it is allowed to spring 
open, pushed by the force of stem spring 112 and a 
compressed door gasket 192. 

Forward travel of door stem 104 when in its 

35 unlocked condition is limited by the engagement of 
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retaining pin 120 with a stopping portion 126 of case 
100. However, by the time door stem 104 has moved 
forwardly this distance, door latch 102 has unhooked 
from stem 104 under the influence of door latch spring 
5 128, which lifts latch 102 about a pivot point 130. 
Door 24 is thus free to open about door hinge 132, 
thereby allowing access to the house key or other 
materials stored in key compartment 20. 

Key compartment locking solenoids 36 return to 
10 their deenergized, locking states 0.25 seconds after 
microswitch 42 is reopened. Plungers 116, 118 are then 
urged against a rear barrel portion 134 of stem 104 if 
the stem is then in its unlocked position. 

When door 24 is closed, latch 102 engages with 
15 a hook portion of stem 104 as these components are 
pushed inwardly. The hook portion of latch 102 has a 
curved upper surface so that it lowers into its latched 
position automatically when it meets the case. The 
front entrance to the bore within which these coupled 
20 elements travel has a chamfered upper portion 135 to 
further facilitate lowering hook portion of latch 102 
into its locked position. With the latch and stem so 
engaged, stem 104 is pushed further inwardly until the 
spring loaded plungers 116, 118 of the key compartment 
25 locking solenoids are able to engage into the turned cut 
portion 110 of the stem. At this point, the door is 
locked. The door is also rendered shock proof in this 
state by the positioning of the latched components 
within the constraining bore which prevents these 
30 components from becoming disengaged. 

Reviewing the key compartment access operation, 
it will be noted that door 24 is positioned on the front 
of lockbox 12 and pivots downwardly to expose the 
lockbox contents. This arrangement facilitates 
35 operation of lockboxes mounted in awkward locations, 



WO 87/05069 



PCT/US87/00374 



- 75 - 

such as on ground level water faucets, especially when 
compared to prior art systems in which the key container 
had to be released from the underside of the lockbox* 
Similarly, the present arrangement in which the key is 
5 coupled to the lockbox simply by bringing the key near 
the slot in the upper front portion of the lockbox 
provides a substantial improvement in operating 
flexibility over prior art systems in which the key had 
to be engaged with the lockbox in a precise position and 

10 then manipulated while in that position in order to 
operate the lockbox. 

The use of a key compartment door 24 on the 
lockbox of the present invention also provides a variety 
of security enhancing features not found in prior art 

15 lockboxes. For example, the shackle release mechanism 
of the present invention is concealed behind the key 
compartment door, thereby protecting it from vandalism 
and providing an additional measure of security to the 
shackle. Similarly, battery compartment retaining bolt 

20 180 and tamper proof screws holding lockbox circuit 

board 182 and the lockbox's rear cover in place are also 
protected from tampering by being positioned behind door 
24. 

Turning now to release of the shackle, Pigs. 2 
25 and 7 show that shackle 22 includes a loop portion 140 
and two end portions 142. Each end portion includes a 
butt portion 144 and a turned cut portion 146. Shackle 
22 is maintained in its locked position by a locking bar 
148, shown in Figs, 4 and 5. When in the locked 
30 position, turned cut portions 146 in both ends of 
shackle 22 are engaged by circular notches 150 in 
locking bar 148. Locking bar 148 is maintained in 
engagement with the turned cuts 146 of shackle 22 by the 
locking bar's own engagement on a shackle stem 162. 
35 Locking bar 148 is engaged on a butt portion 160 of the 



WO 87/05069 



PCT/US87/00374 



- 76 - 

shackle stem by engagement between an elongated cut 164 
in a flat portion 158 of the bar with a groove 166 in 
the butt portion of the stem. Shackle stem 162 is 
spring biased towards the front of the case by a spring 
5 156 compressed between flat portion 158 of locking bar 
148 and the rear of the case. However , stem 162, and 
consequently locking bar 148/ are prevented from moving 
forwardly by the engagement of plungers 168 f 170 of 
shackle locking solenoids" 38 with a turned cut portion 

10 172 in the stem. 

It will be recognized that the above-described 
shackle locking arrangement prevents any external force, 
regardless of how it is applied, from imparting a load 
to shackle locking solenoids 38. For example, if it is 

15 attempted to pull locked shackle 22 out of case 100, 
locking bar 148 will lift slightly off shackle locking 
stem 162 and will immediately engage a casting 152 
(shown -in Fig. 8) in the upper portion of the case. 
(Casting 152 fills the upper portion of the case and 

20 includes two openings 153 sized just to allow passage of 
the end portions 142 of the shackle) . The force pulling 
shackle 22 from case 100 is thus applied entirely 
against casting 152 and does not include any component 
directed against solenoids 38. 

25 Similarly, if it is attempted to push locked 

shackle 22 into case 100 r a pair of shoulders 154 on the 
lower portion of shackle 22 are immediately forced into 
engagement with a pair of protrusions 174 (Fig. 8) 
formed on the top of case 100. (Shoulders 154 and 

30 protrusions 174 are obscured in Figs. 2 and 3 by a 

plastic rain guard 175 formed around shackle 22) . The 
force pushing shackle 22 into case 100 is thus applied 
entirely against the case 100 and again does not include 
any component directed against shackle locking solenoids 

35 38. 
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Even if the ends of shackle 22 are twisted / as 
may occur if a shackle cable (discussed below) is used f 
locking solenoids 38 are still isolated from any load. 
Any twisting motion of the shackle ends simply causes 
5 the turned cut portions 146 of the shackle to turn 
harmlessly in the circular notches 150 of locking bar 
148. 

If release of the shackle has been authorized/ 
lockbox CPO 28 first unlocks the key compartment door 24 

10 to allow access to the shackle locking stem 162 normally 
concealed behind this door* Shackle locking solenoids 
38 are energized for eight seconds beginning two seconds 
after door 24 is opened (as detected by microswitch 
42) . When plungers 168, 170 of energized shackle 

15 locking solenoids 38 attempt to retract, however, they 
are prevented from doing so by their frictional 
engagement with the edge of the turned cut portion 172 
in shackle locking stem 162. This engagement is 
maintained by spring 156 which pushes the edge of the 

20 turned cut portion 172 of the stem against the sides of 
the solenoid plungers. 

In order to release the shackle, the user must 
press shackle locking stem 162 rearwardly a short 
distance so as to free plungers 168, 170 from their 

25 frictional engagement with the edge of turned cut 
portion 172 of the stem. When stem 162 is pressed 
rearwardly in this manner, energized solenoids 38 
immediately retract their plungers from the stem. When 
the plungers retract, stem 62 is allowed to travel 

30 forwardly, no longer bound by the plungers' engagement 
in the turned cut portion 172 of the stem. Thus, when 
the user releases the stem, the stem is allpwed to 
spring forwardly, pushed by the force of compressed 
spring 156. 

35 When shackle stem 162 moves forwardly under the 

force of compressed spring 156, it causes the shackle 
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locking bar 148 r linked to the stem at butt portion 160 , 
to also move forwardly. This forward movement of 
shackle locking bar 148 disengages the circular notches 
in the locking bar from the turned cut portions 146 in 
5 the shackle. (Forward travel of stem 162 and locking 
bar 148 is limited by the locking bar's engagement with 
a stop member 159 formed in case 100) . In this unlocked 
state , the shackle can then be freely withdrawn from the 
lockbox. 

10 If shackle locking stem 162 is not pushed 

inwardly within eight seconds , locking solenoids 38 are 
deenergized, thereby relocking the stem r and 
consequently the shackle, in place. 

(It will be noted that the above described 

15 press-to-release mechanisms provided on both the key 
compartment door and on the shackle locking stem serve 
to remove all loads from the solenoids plungers when 
these plungers are being retracted to their unlocked 
states. Consequently , the solenoids employed in the 

20 present invention can be relatively small , thereby 
reducing both power drain and system cost.) 

When it is desired to relock the shackle , the 
shackle is reinserted in openings 153 in the top of case 
100 and pressed downwardly until shoulders 154 on the 

25 shackle engage the upper protrusions 174. The shackle 
stem 162 , which is protruding forwardly under the 
influence of spring 15 6 , is pressed inwardly by the 
user, thereby causing circular notches 150 in locking 
bar 158 to move back into engagement with turned cuts 

30 146. in the shackle. Stem 162 can be pressed inwardly 
simply by closing key compartment door 24. After the 
shackle stem has been pressed in a distance, plungers 
168, 170 of shackle locking solenoids 38 spring from 
their unlocked positions (pressing against the barrel 

35 portion 176 of stem 162) back into the turned cut 
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portion 172 of the stem. This action relocks the 
shackle stem in its locked position and correspondingly 
locks shackle locking bar 148 in its locking 
relationship with shackle 22. 
5 In addition to the lockbox security features 

already described f door locking stein 104 and shackle 
locking stem 162 also serve security functions by 
rendering the inner workings of the lockbox inaccessible 
to vandalizing users. Once door 24 is opened , as for 

10 example by an authorized user, the two bores in which 
these stems travel could provide passageways to the 
inner workings of the lockbox. A vandalizing user who 
is so inclined might attempt to tamper with the internal 
mechanisms through these passageways. In the present 

15 invention , however , such tampering is thwarted by stems 
104 and 162 which occlude these passageways so as to 
block all access to the inner workings of the lockbox. 

Reviewing other mechanical components of the 
lockbox briefly, primary lockbox battery 32 comprises 

20 five alkaline AA cells mounted next to one another in a 
battery pack 178 mounted in the lower rear of the unit 
and held in place by a bolt 180. An O-ring seal is 
provided around battery pack 178 and around the lockbox 
rear cover to prevent rain and contaminants from 

25 entering the case. The backup battery 34 is mounted on 
a circuit board 182 in the back of the unit f which 
circuit board also supports the lockbox CPU 28 , RAM 30 
and related circuitry. 

Communications coil 26 is mounted in the upper 

30 front of the lockbox, adjacent a receiving nest 184 into 
which the top end of key 14 is inserted. Coupling 
between communications coil 26 and key 14 through the 
metal lockbox case 100 is facilitated by a small slot 
186 that extends through case 100 for the length of coil 

35 186. This slot is filled with an insulating resin 

material that also pots the communications coil in place. 
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Inside key compartment door 24 is a stainless 
steel liner 188 with a lip portion 190 that reinforces 
the door and helps retain the contents near the door as 
the door is being closed. Cellular urethane gaskets 192 
5 are positioned at the points where door 24 contacts the 
case so as to prevent rain and contaminants from 
entering the case. This cellular urethane material 
resists taking a set, thereby assuring a long life for 
the door seals. An injection molded plastic bumper (not 
10 shown) can be provided on the outside of the lockbox so 
as to protect the fixture to which the lockbox is 
mounted (i.e. a door) from abrasion. 

In alternative forms of the invention, shackle 
22 can comprise a vinyl clad steel cable terminated with 
15 appropriately machined ends, such as ends 142 on shackle 
22, so as to permit connection of the lockbox to trees 
and the like. The cable can again be provided with drip 
caps to prevent rain from entering the lockbox. 

Having illustrated and described the principles 
20 of our invention with reference to a preferred 

embodiment and several variations thereof, it should be 
apparent to those skilled in the art that the invention 
can be modified in arrangement and detail without 
departing from such principles. For example, although 
25 the system is described with reference to a lockbox 
system for containing dwelling keys, it is readily 
adaptable to other uses, such as in industrial security 
systems. Similarly , although the preferred embodiment 
has been described as including all the claimed 
30 features, other systems could readily be designed that 
include only some of these features and that include 
other features not here discussed. Accordingly, we 
claim as our invention all such modifications as may 
come within the spirit and scope of the following claims 
35 and equivalents thereof. 
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WE CLAIM: 

1. In a lockbox system in which a movable 

member is latched in place by the plunger of an 
unenergized electrical solenoid and in which the movable 
5 member can be manually moved for a distance despite its 
being latched in place , the system further including a 
solenoid drive circuit through which energy is 
selectively applied to the solenoid from a battery f an 
improvement for conserving battery energy comprising: 
10 switch means operatively coupled to the movable member 
and connected to the drive circuit so that energy is not 
applied to the solenoid through the drive circuit until 
said movable member is manually moved. 

15 2. The system of claim 1 which further 

includes means for applying energy to the solenoid for a 
predetermined period of time after the movable member is 
manually moved. 

20 3. In a lockbox system in which a movable 

member is controllably latched in place by the plunger 
of an electrical solenoid, the improvement comprising a 
second solenoid having a plunger that also latches the 
movable member in place,- the second solenoid being 

25 mounted so that its plunger travels in a direction 

different than the direction of travel of the plunger of 
the first solenoid when said solenoids are energized, 
whereby a physical shock to the system that might cause 
one of said solenoid plungers momentarily to be 

30 propelled in a direction that would cause it to unlatch 
the movable member would cause the other of said 
plungers to be propelled in a direction that would 
maintain the movable member in its latched state. 

35 4. An electronic key for an electronic real 

estate lockbox system comprising: 
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central processor unit and associated first 
programmed memory means having the capacity to execute a 
complete set of lockbox related functions; and 

second memory means containing function 
5 enabling/disabling data for cooperating with said 

central processing unit and associated first programmed 
memory means for enabling execution of selected ones of 
said complete set of lockbox related functions and for 
inhibiting execution of others of said complete set of 
10 lockbox related functions, 

whereby a key that can execute only selected 
oner of said complete set of lockbox related functions 
can be tailored by inhibiting the execution of those of 
the complete set of lockbox related functions which are 
15 not desired. 

5 An electronic lockbox system according 

to claim 4 which further includes second memory 
programming means for loading into the second memory 
20 means a set of function enabling /disabling data 

corresponding to the enablement of a desired set of 
lockbox related functions. 

6. An electronic key according to claim 4 
25 in which the key further comprises display means capable 

of displaying a collection of symbols indicative of the 
lockbox related functions which the central processing 
unit and associated programmed first memory means has 
the capacity to execute and in which the system further 
30 includes means for removing from the displayed 

collection of symbols those symbols corresponding to 
functions which have been inhibited. 

7. In an electronic lockbox system having 
35 an electronic locking apparatus powered by a battery, an 

improvement comprising: 
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determining means for determining when the 
battery is nearing the end of its useful life; 

counting means for counting uses of the locking 
apparatus after the determining means determines that 
5 the battery is nearing the end of its useful life; and 

threshold means for curtailing operation of the 
locking apparatus after the counting means counts to a 
predetermined point. 

10 8. The system of claim 7 which further 

includes means for ascertaining the identity of users of 
the locking apparatus and in which the threshold means 
inhibits operation of the locking apparatus by all but 
selected users of the locking apparatus after the 

15 counting means counts to a predetermined point. 

9. The system of claim 7 which further 
comprises detector means for detecting the installation 
of a battery in the locking apparatus and in which the 

20 determining means determines when the battery is nearing 
the end of its useful life by monitoring the approximate 
amount of energy consumed by the electronic locking 
apparatus since the detector means detected the 
installation of the battery in the locking apparatus. 

25 

10. The system of claim 7 in which the 
locking apparatus includes a primary battery from which 
power is normally drawn and a backup battery from which 
power can be drawn when the primary battery is unable to 

30 supply adequate power and in which the determining means 
determines when the primary battery is nearing the end 
of its useful life by monitoring whether any power is 
being drawn from the backup battery. 

35 11. The system of claim 7 which further 

comprises detector means for detecting the installation 
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of a battery in the locking apparatus and in which the 
determining means determines when the battery is nearing 
the end of its useful life by monitoring the time 
elapsed since the detector means detected the 
5 installation of a battery in the locking apparatus. 

12. An electronic key capable of executing a 
plurality of functions in conjunction with an electronic 
real estate lockbox comprising: 

10 display means for displaying visual symbols 

representative of the plurality of functions; 

function selection means for selecting one of 
said plurality of functions for execution by the 
electronic key in conjunction with the electronic 

15 lockbox; and 

display driver means cooperating with the 
display means and the function select means for causing 
the visual symbol associated with the selected function 
to blink in the display means. 

20 

13. The electronic key of claim 12 in which 
the visual symbols are disposed in a regular array in 
the display means and in which the function select means 
includes switch means for causing the blinking feature 

25 to move to an adjoining element in the array of symbols, 
whereby the desired function is selected by moving the 
blinking feature in the display means to the visual 
symbol corresponding to the desired function. 

30 14. An electronic lock system comprising an 

electronic lock, said lock including memory means for 
storing a lock access code having at least two portions, 
the system further comprising an electronic key for 
cooperating with the electronic lock to execute an 

35 operation, the electronic key including memory means for 
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storing a key access code comprised of at least two 
portions, the system further including permission means 
for storing a permission code and control means 
cooperating with the permission means for controlling 
execution of said operation, the permission code 
dictating the degree of correspondence between the 
portions of the lock access code and the portions of the 
key access code required by the control means before 
said control means will allow execution of the operation. 



15* An electronic real estate lockbox system 
according to claim 14 in which: 

the electronic key can cooperate with the 
electronic lock to execute a variety of functions; 
15 the permission means stores a plurality of 

permission codes corresponding to different ones of said 
variety of operations; 

the portions of the lock and key codes identify 
the agents, agencies and real estate boards to which the 
20 lock and key are assigned; and in which 

the control means prevents execution of an 
operation unless the degree of correspondence between 
the lock and key codes specified by the permission code 
corresponding to that operation is met. 

25 

16. The system of claim 14 in which the 
portions of the lock and key codes identify the agents, 
agencies and real estate boards to which the lock and 
key are assigned and in which one degree of 
30 correspondence specified by a permission code is a match 
between the portion of the lock code identifying the 
real estate board to which the lock is assigned and the 
portion of the key code identifying the real estate 
board to which the key is assigned. 

35 
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17. The system of claim 16 in which an 
additional degree of correspondence specified by a 
permission code is a match between the portion of the 
lock code identifying the agency to which the lock is 

5 assigned and the portion of the key code identifying the 
agency to which the key is assigned. 

18. The system of claim 17 in which an 
additional degree of correspondence specified by a 

10 permission code is a match between the portion of the 
lock code identifying the agent to which the lock is 
assigned and the portion of the key code identifying the 
agent to which the key is assigned. 



15 19. In a lockbox having a shackle , shackle 

locking means for selectively locking the shackle and a 
secure compartment/ said compartment having opened and 
closed states , the improvement comprising means for 
automatically causing the shackle locking means to lock 

20 the shackle when the compartment is closed from its open 
state. 

20. An electronic lockbox system including a 
lockbox and an electronic key, the lockbox comprising: 
25 communication means for relaying data between 

the lockbox and the electronic key; 

memory means for containing a lockbox access 

code ; and 

control means for controlling operation of the 

30 lockbox; 

the electronic key comprising: 
memory means for containing a key access code 
and an expiration date code; and 

communication means for relaying data between 
35 the electronic key and the lockbox; 

the system further including: 
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calendar means for providing calendar data 
indicative of the date; 

logic means for comparing the calendar data 
from the calendar means with the expiration date code 
5 from the electronic key memory means to determine 
whether the key is expired , and 

means for allowing access to the secure 
compartment upon correspondence between the key and 
lockbox access codes only if it is determined that the 
10 ke Y is not expired* 

21. An electronic lockbox system according 
to claim 20 in which the key memory contains a plurality 
of key access codes, each of said key access codes 

15 having a corresponding expiration date stored in the key 
memory means and in which the logic means compares the 
calendar data from the calendar means with the 
expiration date corresponding to each of the key access 
codes for determining whether any of the key access 

20 codes are to be used to authorize access to the secure 
compartment. 

22. An electronic real estate lockbox system 
comprising a lockbox and a key, the lockbox including: 

25 communications means for relaying data between 

the lockbox and the key? 

key receiving means for facilitating the 
relative positioning of the lockbox and the key so that 
the communications means can relay data between the 
30 lockbox and the key; 

key compartment means for releasably containing 
a house key; 

key compartment lock means for controllably 
securing the key compartment means in a locked state; 
35 key compartment control means for unlocking the 

key compartment lock means upon receipt of proper data 
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from the key via the communications means; 

shackle means for releasably fastening the 
lockbox to a fixed object; 

shackle retention means having released and 
5 retained states for controllably securing the shackle ? 
means in a locked position; and 

shackle control means for releasing the * 
retention means upon receipt of proper data from the key 
via the communications means; 
10 the key including: 

communications means for relaying data between 
the key and the lockbox; 

circuit means for controlling operation of the 

key; 

15 battery means for supplying power to the 

circuit means; 

first switch means for controlling the 

application of power to the circuit means so as to 

activate said circuit means; 
20 second switch means for causing the circuit 

means and the key communication means to cooperate so as 

to send data to the lockbox for causing the lockbox key 

compartment control means to unlock the key compartment 

lock means; 

25 third switch means for causing the circuit 

means and the communication means to cooperate so as to 
send data to the lockbox for causing the lockbox shackle 
control means to release the shackle retention means; 

keypad means comprising a plurality of switches 
30 for permitting a user to enter data into the key; and 
indicator means for providing feedback to the 
user on the operational status of the key. 

23. The electronic real estate lockbox 
35 system of claim 22 which further comprises: 
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memory means in the key for storing expiration 
date data; 

calendar means for providing data indicative of 

the date; 

5 logic means for comparing the expiration date 

data from the key memory means with the date data from 
the calendar means; and 

control means cooperating with said logic means 
for preventing unlocking of the key compartment lock 
10 means if the state of the logic means matches a 
predetermined state. 

24. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 

15 means for storing lockbox characterization instructions 
that characterize certain features of the lockbox and in 
which the key further includes memory means for 
receiving lockbox characterization instructions , the key 
and lockbox further comprising means for effecting the 

20 transfer of said lockbox characterization instructions 
from the key to the lockbox to thereby enable 
recharacterization of the lockbox by the key. 

25. The electronic real estate lockbox 

25 system of claim 22 in which the lockbox further includes: 
memory means for storing data entries relating 
to operations of the lockbox; and in which the key 
further includes: 

interrogation means for obtaining from the 
30 lockbox data indicating the number of such data entries 
in the lockbox memory means; and 

display means on the key for indicating to a 
key user the number of such data entries in the lockbox 
memory . 
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26. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 
a battery for supplying power to the key compartment 
lock means and to the shackle retention means f means for 

5 determining when the battery is reaching the end of its 
useful life and for producing a low battery signal 
corresponding thereto, counting means for counting 
operations of the lockbox after the low battery signal 
is produced and means for curtailing operation of the 
10 lockbox when the counting means counts to a 
predetermined point. 

27. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 

15 a battery for supplying power to the key compartment 
lock means and means for preventing the application of 
power from the battery to the key compartment lock means 
until a user exerts an opening force on the key 
compartment means. 

20 

23. The electronic real estate lockbox 
system of claim 22 in which the key compartment lock 
means comprises a pair of solenoids for controllably 
securing the key compartment means , each of said 
25 solenoids having a plunger , said solenoids being 
oriented so that their plungers travel in different 
directions when energized. 

29. The electronic real estate lockbox 
30 system of claim 22 in which the shackle retention means 
comprises a pair of solenoids for controllably securing 
the shackle means, each of said solenoids having a 
plunger, said solenoids being mounted so that their 
plungers travel in different directions when energized. 
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30. The electronic real estate lockbox 
system of claim 22 in which the key further includes: 

means having the capacity for causing the 
lockbox to execute a plurality of functions; 
5 memory means for storing enable/disable data 

corresponding to certain of said lockbox functions for 
indicating whether said functions are to be enabled or 
disabled; and 

logic means cooperating with the memory means 
10 for preventing the key from causing the lockbox to 
execute those functions which the corresponding 
enable/dAsable data in the memory means indicates are to 
be disabled. 

15 31. The electronic real estate lockbox 

system of claim 22 in which the lockbox further includes 
data logging means for storing data entries relating to 
the identities of keys that have been used to cause the 
key compartment lock means to unlock and in which the 

20 key further includes means for causing data identifying 
the key to be stored in the data logging means without 
the key also causing the key compartment lock means to 
unlock. 

25 32. The electronic real estate lockbox 

system of claim 22 in which the lockbox further includes 
memory means for storing data indicating whether access 
to the key compartment means is to be especially 
restricted f the system further including means requiring 

30 a first proper sequence of switch closures on the keypad 
means in order for the key to cause the lockbox key 
compartment lock means to unlock if the data in the 
lockbox memory means indicates that access to the key is 
not to be especially restricted r said means further 

35 requiring a second proper sequence of switch closures on 
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the keypad means in order for the key to cause the 
lockbox key compartment lock means to unlock if the data 
in the lockbox memory means indicates that access to the 
key compartment is to be especially restricted. 

5 

33. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 
memory means for storing lockout list data corresponding 
to the identities of preselected keys that are to be 

10 prevented from gaining access to the key compartment 

means and in which the key further includes memory means 
for storing key identifying data f the system further 
comprising means for comparing the key identifying data 
with the lockout list data stored in the lockbox memory 

15 means and for preventing operation of the lockbox if the 
key identifying data corresponds to any of the lockout 
list data stored in the lockbox memory means. 

34. The electronic real estate lockbox 
20 system of claim 33 which further comprises means for 

loading into the lockbox memory means the lockout list 
data corresponding to the identities of the preselected 
keys which are to be prevented from operating the 
lockbox. 

25 

35. The electronic real estate lockbox 
system of claim 33 which further comprises means for 
disabling the key if the identifying data received from 
the key corresponds to any of the lockout list data 

30 stored in the lockbox memory means. 

36. The electronic real estate lockbox 
system of claim 33 in which the lockbox memory means 
also contains date data indicative of the timeliness of 

35 the lockout list data stored in said memory means and in 
which the key further includes memory means for storing 
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lockout list data corresponding to the identities of 
preselected keys that are to be prevented from opening 
the lockbox r said key memory means further containing 
date data indicative of the timeliness of the lockout 
list data stored in said key memory, the system further 
including means for comparing the date data stored in 
the lockbox and key memory means in order to determine 
which of said lockout list data is the most timely and 
means for transferring the most timely lockout list derta 
and its associated date data into the memory means 
having the least timely lockout list data* 

37. The electronic real estate lockbox 
system of claim 22 in which the key further includes 

15 memory means for storing diagnostic information on 
operations attempted by the key. 

38. The electronic real .estate lockbox 
system of claim 22 in which the key further includes 

20 means requiring a certain sequence of switch closures on 
the keypad means in order for the key to cause the 
lockbox to operate and means for allowing said sequence 
of switch closures to be effected on the keypad means 
prior to the key being received by the lockbox key 
25 receiving means, the system further comprising means for 
sending signals to the lockbox corresponding to said 
certain sequence of switch closures automatically when 
the key is received by the lockbox key receiving means. 

39. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 
memory means for storing data entries relating to 
operations of the lockbox by a key, and in which the 
system further includes means for causing a file mark to 
be inserted in the lockbox memory means, means for 
retrieving all of the data entries from the lockbox 
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memory means and means for retrieving only data entries 
stored in the lockbox memory means after a file mark was 
inserted in said memory means. 

5 40, The electronic real estate lockbox 

system of claim 22 in which the lockbox further includes 
memory means for storing lockbox characterization 
• instructions that characterize certain features of the 
lockbox, antenna means for receiving characterization 
10 instructions modulated on a radio frequency carrier , 
receiver means coupled to the antenna means for 
deniodulating said modulated instructions and means for 
loading said demodulated instructions from the receiver 
means into the memory means. 

15 

41. The electronic real estate lockbox 
system of claim 22 in which the key further includes 
memory means for storing a key access code that 
identifies the real estate board responsible for said 

20 key and in which the lockbox further includes memory 
means for storing a plurality of lockbox access codes, 
each of said access codes identifying a real estate 
board, the system further including means for comparing 
the key access code with the lockbox access codes and 

25 for allowing access to the key compartment means if any 
of the lockbox access codes match the key access code, 
whereby a key can be used to operate lockboxes that are 
not owned by the real estate board that owns the key. 

30 42 # The electronic real estate lockbox 

system of claim 22 in which the lockbox further includes: 

memory means for storing data corresponding to 
a first time of day and data corresponding to a second 
time of day; 

35 clock means for providing data indicating the 

time of day; 
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logic means for comparing the time of day data 
provided by the clock means with the time data stored in 
a lockbox memory means; 

control means for preventing unlocking of the 
lockbox key compartment means if the logic means 
determines that the time of day is between the first 
time of day and the second time of day stored in the 
lockbox memory means; and 

means for loading said data corresponding to 
the first and second times of day from the lockbox 
communications means into the lockbox memory means; and 
in which the key further includes: 

means for operating with the key communications 
means for loading data corresponding to said first and 
second times of day into the lockbox memory means. 

43. The electronic real estate lockbox 
system of claim 22 in which the lockbox further includes 
memory means for storing data identifying a real estate 
agency whose keys are to be allowed to unlock the 
lockbox key compartment means and in which the key 
further includes memory means for storing data 
identifying the real estate agency to which the key is 
assigned, the system further including means for 
comparing the data identifying the real estate agency to 
which the key is assigned with the data identifying a 
real estate agency whose keys are to be allowed to 
unlock the lockbox key compartment means and for 
allowing unlocking of the lockbox key compartment means 
only if such data corresponds. 

44. The electronic real estate lockbox 
system of claim 22 in which the lockbox includes memory 
means and means for storing in said memory means 
diagnostic data relating to conditions detected during 
the course of operation of the lockbox that cause the 
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lockbox not to allow access to the key compartment 
means , whereby resolution of anomalous lockbox behavior 
can be facilitated by examination of said stored 
diagnostic data. 

5 

45. The electronic real estate lockbox 
system of claim 22 in which the key further includes key 
identifying data for identifying the owner of the key 
and in which the lockbox further includes: 

10 access logging means for storing data relating 

to accesses to the key compartment means; 

the system further comprising logic means for 
permitting retrieval of the data from the access logging 
means only by keys having predetermined key identifying 

15 data. 

46. The electronic real estate lockbox 
system of claim 22* in which the key compartment means 
comprises a door pivotally mounted to a lockbox case and 

20 secured to said case by a hinge and by the key 
compartment lock means. 

47. The electronic real estate lockbox 
system of claim 22 in which the lockbox and key each 

25 contain a data processing unit and in which the lockbox 
data processing unit can authorize unlocking of the key 
compartment means based on evaluation of a first set of 
access criteria and in which the key data processing 
unit can authorize unlocking of the key compartment 

30 means based on an evaluation of a second set of access 
criteria. 

48. The electronic real estate lockbox 
system of claim 22 in which one of said communications 

35 means includes a first inductor and means for applying a 
data signal to be communicated to the first inductor and 
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in which the other of said communications means includes 
a second inductor and Schmidt trigger means for 
reconstructing digital data from transients induced in 
the second inductor by the data signal applied to the 
5 first inductor. 
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